Power module for common unmanned system architecture

ABSTRACT

Apparatus and methods for controlling unmanned systems (UMSs), such as unmanned aircraft, are provided. A UMS can be provided that includes core systems, auxiliary systems, a payload, and a power system. The power system can provide uninterruptible power for a first power domain that includes the core systems. The power system can provide interruptible power for each of a second power domain and a third power domain. The second power domain can include the auxiliary systems, and the third power domain can include the payload. First circuitry of the power system can prevent a single overcurrent fault in the third power domain from causing an electrical fault in either the first power domain or the second power domain. Second circuitry of the power system can prevent a single overcurrent fault in the second power domain from causing an electrical fault in the first power domain.

FIELD

The present disclosure generally relates to unmanned systems (UMSs), andmore particularly to methods and apparatus related to providing anunmanned system architecture utilizing common computational componentsthat save size, weight, power, and cost while performing multiple roleswithin the unmanned system.

BACKGROUND

Unmanned systems, such as unmanned aircraft, have to be reliable. Inparticular, both unmanned and manned aircraft have to be very reliable,especially while airborne. To ensure reliability, a typical aircraftoften utilize one or more redundant components. For example, largecommercial airliners have multiple engines and fuel tanks to maintainflight even in the presence of one or more engine failures. As anotherexample, redundant electronic components, such as avionics, on-boardcomputers, and related networking equipment, can be utilized to ensurethat an unmanned aircraft can maintain flight even after a failure ofone or more electronic components aboard the unmanned aircraft.

SUMMARY

In one example, a method is provided. An unmanned system (UMS) isprovided. The unmanned system includes a physical computer, one or moreauxiliary systems for the unmanned system, and a payload. The physicalcomputer executes software on the physical computer to cause thephysical computer at least to instantiate a plurality of virtualcomputers that include a mission virtual computer and a payload virtualcomputer. The mission virtual computer and the payload virtual computerare for: controlling the one or more auxiliary systems for the unmannedsystem using the mission virtual computer, communicating with thepayload using the payload virtual computer, determining whether asoftware fault has occurred on one virtual computer of the plurality ofvirtual computers, and after determining that a software fault hasoccurred on one virtual computer of the plurality of virtual computers,preventing the software fault from causing a fault on a differentvirtual computer of the plurality of virtual computers.

In another example, an unmanned system is described. The unmanned systemincludes: a physical computer; one or more auxiliary systems for theUMS; and a payload. The physical computer includes software that, whenexecuted by the physical computer, causes the physical computer at leastto instantiate a plurality of virtual computers that include a missionvirtual computer and a payload virtual computer. The mission virtualcomputer and the payload virtual computer are for: controlling the oneor more auxiliary systems for the UMS using the mission virtualcomputer, communicating with the payload using the payload virtualcomputer, determining whether a software fault has occurred on onevirtual computer of the plurality of virtual computers; and afterdetermining that a software fault has occurred on one virtual computerof the plurality of virtual computers, preventing the software faultfrom causing a fault on a different virtual computer of the plurality ofvirtual computers.

In another example, a non-transitory computer readable medium isdescribed. The non-transitory computer readable medium having storedthereon software, that when executed by one or more processors of aphysical computer of an unmanned system, cause the physical computer toperform functions. The functions include: instantiating a plurality ofvirtual computers that include a mission virtual computer and a payloadvirtual computer for: controlling one or more auxiliary systems for theUMS using the mission virtual computer, and communicating with a payloadof the UMS using the payload virtual computer, determining whether asoftware fault has occurred on one virtual computer of the plurality ofvirtual computers, and after determining that a software fault hasoccurred on one virtual computer of the plurality of virtual computers,preventing the software fault from causing a fault on a differentvirtual computer of the plurality of virtual computers.

In another example, an unmanned system is described. The unmanned systemincludes: one or more core systems for the unmanned system, one or moreauxiliary systems for the unmanned system; a payload; a physicalcomputer; a network, and a power system. The network enables thephysical computer to communicate with the one or more auxiliary systemsfor the unmanned system using at least a second tier of communications,and to communicate with the payload using a third tier ofcommunications. The network and the physical computer logically separateat least the second tier of communications and the third tier ofcommunications. The power system provides a first power domain for theone or more core systems for the unmanned system, a second power domainfor the one or more auxiliary systems for the unmanned system, and athird power domain for the payload. The power system includes firstcircuitry that inhibits a single overcurrent fault in the third powerdomain from causing an electrical fault in either the first power domainor the second power domain and second circuitry that inhibits a singleovercurrent fault in the second power domain from causing an electricalfault in the first power domain.

In another example, a method is provided. An unmanned system is providedthat includes one or more core systems for the unmanned system, one ormore auxiliary systems for the unmanned system a payload, a physicalcomputer, a network, and a power system. The network and the physicalcomputer are logically separated into at least a second tier ofcommunications and a third tier of communications for at least:communicating between the physical computer and the one or moreauxiliary systems for the unmanned system using the second tier ofcommunications, and communicating between the physical computer and thepayload using the third tier of communications. The power systemprovides: a first power domain for the one or more core systems for theunmanned system, a second power domain for the one or more auxiliarysystems for the unmanned system, and a third power domain for thepayload. First circuitry of the power system is utilized to inhibit asingle overcurrent fault in the third power domain from causing anelectrical fault in either the first power domain or the second powerdomain. Second circuitry of the power system is utilized to inhibit asingle overcurrent fault in the second power domain from causing anelectrical fault in the first power domain.

In another example, a method is provided. An unmanned system is providedthat includes one or more core systems for the unmanned system, one ormore auxiliary systems for the unmanned system, a payload, and a powersystem. The power system provides uninterruptible power for a firstpower domain. The first power domain includes the one or more coresystems for the unmanned system. The power system provides interruptiblepower for each of a second power domain and a third power domain. Thesecond power domain includes the one or more auxiliary systems for theunmanned system. The third power domain includes the payload. Firstcircuitry of the power system prevents a single overcurrent fault in thethird power domain from causing an electrical fault in either the firstpower domain or the second power domain. Second circuitry of the powersystem prevents a single overcurrent fault in the second power domainfrom causing an electrical fault in the first power domain.

In another example, an unmanned system is described. The unmanned systemincludes: one or more core systems for the unmanned system; one or moreauxiliary systems for the unmanned system; a payload; and a powersystem. The unmanned system is configured for: providing uninterruptiblepower for a first power domain using the power system, the first powerdomain including the one or more core systems for the unmanned system;providing interruptible power for each of a second power domain and athird power domain using the power system, the second power domainincluding the one or more auxiliary systems for the unmanned system, andthe third power domain including the payload; preventing a singleovercurrent fault in the third power domain from causing an electricalfault in either the first power domain or the second power domain usingfirst circuitry of the power system; and preventing a single overcurrentfault in the second power domain from causing an electrical fault in thefirst power domain using second circuitry of the power system.

In another example, a method is provided. An unmanned system is providedthat includes a network, one or more auxiliary systems for the unmannedsystem, and a payload. The network connects the one or more auxiliarysystems for the unmanned system and the payload. A network switch of thenetwork logically separates the network into at least a second tier ofcommunications and a third tier of communications. The network controlsthe unmanned system by at least: controlling the one or more auxiliarysystems for the unmanned system using messages communicated by thesecond tier of communications, and communicating with the payload usingmessages communicated by the third tier of communications.

In another example, an unmanned system is described. The unmanned systemincludes: one or more auxiliary systems for the unmanned system; apayload; and a network having a network switch. The network connects theone or more auxiliary systems for the unmanned system and the payload.The network is logically separated into at least a second tier ofcommunications and a third tier of communications using the networkswitch. The unmanned system is controlled using the network by at least:controlling the one or more auxiliary systems for the unmanned systemusing messages communicated by the second tier of communications, andcommunicating with the payload using messages communicated by the thirdtier of communications.

The features, functions, and advantages that have been discussed can beachieved independently in various embodiments or may be combined in yetother embodiments further details of which can be seen with reference tothe following description and drawings.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a diagram of an unmanned system, according to an exampleembodiment.

FIG. 2 is a block diagram of a portion of a power system of the unmannedsystem of FIG. 1, according to an example embodiment.

FIG. 3 is a block diagram of a communications network of the unmannedsystem of FIG. 1, according to an example embodiment.

FIG. 4 is a block diagram of another communications network of theunmanned system of FIG. 1, according to an example embodiment.

FIG. 5 is a block diagram illustrating an input/output node of theunmanned system of FIG. 1, according to an example embodiment.

FIG. 6 is a flowchart of a method for controlling an unmanned system,according to an example embodiment.

FIG. 7 is a flowchart of a method for providing an unmanned system,according to an example embodiment.

FIG. 8 is a flowchart of a method for operating an unmanned system,according to an example embodiment.

FIG. 9 is a flowchart of another method for controlling an unmannedsystem, according to an example embodiment.

DETAILED DESCRIPTION

Herein is described an architecture for an unmanned system (UMS), suchas an unmanned system, such as an aircraft, that utilizes componentsarranged in a unique configuration to reduce size, weight, cost, andpower required to control the unmanned system. The architecture isbased, for example, on several techniques:

1. Separation of networks of components of the unmanned system bycriticality.

2. Maximizing use and reuse of reference design circuits within theunmanned system (and perhaps other unmanned systems).

3. Pushing input/output processing into lower-criticality networks usinginput/output nodes (IONs) of the unmanned system by, where theinput/output nodes enable communication using widely availablecommunications protocol(s) between input/output devices and the rest ofthe unmanned system.

4. Providing power protection and/or isolation of networks of componentswithin the unmanned system using one or more common, programmable, andreusable power modules and utility connectors (UCs).

5. Reducing size, cost, power, and weight of computing components byvirtualizing control computers within the unmanned system.

This architecture includes features to support scalability and wideapplicability across a range of platforms and UMS controls; e.g.,avionics subsystems for unmanned aircraft. For example, in an unmannedaircraft application, the architecture includes a general autopilotinterface compatible with various autopilots; a general location sensor(e.g., Global Positioning System (GPS)) interface compatible withmultiple receivers, a remote control/command and control (C2) interface,an extensible input/output subsystem that allows the architecture togrow and expand to meet the needs of future unmanned aircraft, and ascalable power management subsystem that can support a range of unmannedaircraft sizes. As such, the architecture can be used in a wide varietyof unmanned (and perhaps manned) systems, such as vehicles and relatedsupport systems including but not limited to, fixed-wing aircraft,aircraft with rotors (e.g., quadcopters, helicopters), ground supportsystems for aircraft, land-based vehicles, surface-water vehicles, andunderwater vehicles.

The architecture include components of the unmanned system connected bya mixed-criticality communications network that enables one physicalnetwork to safely, efficiently, and reliably handle message traffichaving a variety of priorities to share the physical network. Forexample, an unmanned aircraft using the mixed-criticality communicationsnetwork can communicate high-priority flight-critical traffic concurrentwith low-priority payload traffic in a safe manner. Using one physicalnetwork in comparison with physical separation of high-priority andlow-priority network traffic can significantly reduce network size,weight, cost, and power.

The architecture includes a single physical computer, perhaps havingmultiple cores, executing hypervisor-based software that virtualizesmultiple virtual machines executing on the single physical computer toperform multiple roles used in controlling the unmanned system. Forexample, the single physical computer can be a system on a module (SoM)usable for managing system communications and signal prioritization. Insome examples, a SoM can provide multiple computer cores that reside ina small form factor using an industry-standard interface socket design.Using the industry-standard interface socket design allows changes(e.g., upgrades or downgrades) of the single physical computer based onsystem requirements and/or cost drivers without impact to software andhelps to extend the lifespan of the architecture before significantchanges in computing hardware are required.

The hypervisor-based software includes a hypervisor that enablessimultaneous operation of multiple virtual computers that can beutilized in the unmanned system. In some examples, the hypervisor canhave a core-to-virtual computer allocation of one or more cores of thesingle physical computer for each virtual computer; while in otherexamples, the hypervisor can schedule execution of each virtual computeron multiple cores of the single physical computer; e.g., by schedulingtime to execute software for each virtual computer on some or all of thecores of the single physical computer. The hypervisor also enablesmemory separation between virtual computers, thereby preventing unwantedtampering of critical systems. Development of separate virtual computersallows for maintenance of strict control over part of the systemsoftware; e.g., virtual computer software controlling core unmannedsystem systems, while allowing variation in other portions of systemsoftware; e.g., virtual computer software controlling payloads. Then, inthis example, a change in virtual computer software controlling payloadscan be isolated from the virtual computer software controlling coreaspects of the unmanned system. Further, since the virtual computersoftware controlling payloads is isolated from the virtual computersoftware controlling core vehicle systems, new and/or different payloadscan be designed and tested out without impacting the core vehiclesystems. Other examples are possible as well.

Similar to the mixed-criticality communications network, legacyplatforms can instantiate multiple physical computers in order toisolate high-priority software functions from low-priority softwarefunctions; e.g., some legacy aircraft systems use two (or more) physicalcomputers such as a flight computer for controlling the aircraft and apayload computer for controlling a payload of the vehicle. The multiplevirtual computers can effectively isolate unmanned system and payloadsoftware functions, and so can meet requirements of regulatory approvalagencies. And, using the single physical computer provides significantsavings in size, weight, cost, and power in comparison to the use ofmultiple physical computers.

The architecture enables unmanned system customization including use ofvarious payloads; e.g., one or more payloads having sensors,communications devices, cameras/imaging systems, etc. The variousunmanned system components and payload(s) can use a number of standardcommunications protocols; e.g., Ethernet, Transmission ControlProtocol/Internet Protocol (TCP/IP), User Datagram Protocol (UDP),Controller Area Network (CAN) protocols, RS-232. Use of a number ofstandard communications protocols increases scope and capabilities ofthe architecture with minimal changes; e.g., by allowing fast swappingin of upgraded aircraft and/or payload devices that use one of thenumber of standard communications protocols supported by thearchitecture.

The architecture utilizes input/output nodes (IONs), each having amicroprocessor for managing a number of analog and digital input/outputinterfaces for communicating with various input/output devices of theunmanned system while using multiple standard communication protocols.Example input/output devices include, but are not limited to unmannedsystem/vehicle control systems, unmanned system/vehicle managementsystems, and payload devices. In some examples, one or more input/outputnodes can be included in a field swappable module (FSM) that candirectly communicate with the rest of the vehicle or be added in cascadewith other modules. The input/output nodes can be connected to themixed-criticality communications network using standard communicationsprotocols; e.g., UDP and/or TCP/IP over Ethernet. Using flexibleinput/output nodes that support multiple different analog and digitalinterfaces and communicate using multiple different protocols allows forhardware customization of devices managed by the input/output nodes withlittle or no software and/or hardware reconfiguration of the rest of thearchitecture.

The architecture includes a power system with a number of scalable powermodules to provide a plurality of power domains throughout an unmannedsystem. The power system can receive electrical power from a number ofpower sources (e.g., batteries, engines/propulsion units, fuel cells) ofpossibly varying quality and distribute the power throughout theunmanned system. Each power module in the power system can control andmeasure power delivery to vehicle subsystems connected to the powermodule. In an aircraft example, a payload system could fail in flightand a power module connected to the power system could consequentlydetermine that the payload system is drawing excessive power to allowthe aircraft to return to base, and so immediately could stop deliveringpower to part or all of the payload system. The power module can includean adjustable circuit breaker function that allows software control ofpower provided by the power module. Additionally, power modules arearranged by the architecture to automatically protect higher-prioritypower domains from electrical faults in lower-priority power domains.Also, the power module can shed non-critical power in the event of avehicle-wide power fault.

In combination, the architecture can use multiple power domains andmultiple communications tiers to respectively provide power andcommunications with multiple vehicle systems. In some examples, thearchitecture can specify use of sets of at least three power domains andthree related tiers of communications for controlling three “networks”or sets of vehicle systems: a tier one (T1) network of core vehiclesystems (and/or other core aspects of unmanned systems), a tier two (T2)network of auxiliary vehicle systems (and/or other auxiliary aspects ofunmanned systems), and a tier three (T3) network of payload systems. Inother examples, an unmanned system can use more, fewer, and/or differentsets of power domains and/or related tiers of communications than theT1/T2/T3 networks and related power domains mentioned above. Moreparticularly, other example sets of power domains and/or related tiersof communications can provide power and/or communications forhigher-level criticality systems (e.g., safety critical systems,security critical systems) and/or lower-level systems (e.g., maintenancesystems, troubleshooting systems, training systems).

Each of the T1, T2, and T3 networks can be managed by separate virtualcomputers; that is, a main virtual computer can manage the T1 network,an auxiliary virtual computer can manage the T2 network, and a payloadvirtual computer can manage the T3 network. Each of the T1, T2, and T3networks can be isolated with two main exceptions: the common physicalcomputer supporting these virtual computers and one or more networkswitches that connect network nodes in both the T2 and T3 networkswithout interchanging messages between the T2 and T3 networks.

The T1 network can provide guaranteed bandwidth and uninterruptablepower to core vehicle systems. In the example of an unmanned aircraft,the core vehicle systems can include an autopilot, servomechanisms (orservos for short) that move control surfaces of the unmanned aircraft,and avionics sensors. Then, position and stability controls for theunmanned aircraft are only communicated within the T1 network, therebyensuring that C2 operations are guaranteed sufficient bandwidth, evenwhen auxiliary vehicle systems and/or payload systems utilize a greatdeal of bandwidth. In this example, the core vehicle systems enable theunmanned aircraft to perform (albeit in a possibly degraded fashion) inthe presence of faults in the auxiliary unmanned vehicle systems and/orthe payload systems.

As a more specific example, the above-mentioned unmanned aircraft canhave a remote control interface, such as a radio, for a human controllerto provide C2 commands to direct the unmanned aircraft—then, the corevehicle systems enable the unmanned aircraft to maintain safe and stableoperations with predetermined basic navigation even when the remotecontrol interface fails. Also, the main virtual computer for the T1network can recognize a loss of communications via the remote controlinterface and can execute emergency procedures to insure safe operationuntil the remote control interface is reestablished. In this way avehicle can run self-diagnostics in the T2 network while independentlymaintaining safe operation of the vehicle in the T1 network. Usingpre-programmed navigation data, the main virtual computer can use theemergency procedures to direct the unmanned aircraft in a predeterminedmanner (e.g., to fly at a predetermined altitude, speed and/or velocity;to fly to a predetermined location) without human intervention/error.

Some core vehicle systems connected to the T1 network include locationsensors; e.g., GPS systems, that provide continuous or nearly-continuouslocation positional assessment capabilities. Location data determined bythe location sensors can then be provided to the autopilot via the T1network without interruption. The architecture can be configured so thatsensors located in the T2 and/or T3 networks can provide data to theautopilot and/or other core vehicle systems. A power domain associatedwith the T1 network can be powered using a battery and perhaps otherpower sources, where the battery can automatically take over theresponsibility of keeping the vehicle powered in the event of criticalpower faults, such as failure of a propulsion unit (i.e., engine) and/orovercurrent faults in the T2 and/or T3 networks. Then, the power systemproviding the power domain can detect the critical power faults andresponsively switch off unnecessary power loads instantaneously, both tosave power and to protect components of the T1 network.

The T2 network can provide bandwidth and interruptible power toauxiliary vehicle systems. Continuing the unmanned aircraft examplementioned in the context of the T1 network, the T2 network can includethe remote control interface, lighting systems, transponders, propulsionunits, tethered power sources, and perhaps other non-payload systems ofthe unmanned aircraft. In this example, the T2 network can routecommunication of C2 commands provided using the remote control interfaceto the T1 network without interference of other communications on the T1network. Also, the T2 network can be designed as isolated from the T3network, so communications within the T2 network (e.g., C2 messagesand/or commands) can be unperturbed by communications within the T3network (e.g., payload-related messages).

Communications in the T2 and/or T3 networks can be tagged with qualityof service (QoS) information that enables a network switch to route theQoS-tagged communications and provide bandwidth control related to theQoS-tagged communications of the T2 and/or T3 networks. Input/outputnodes can be connected to the T2 network and/or T3 network via Ethernet(or perhaps other communication protocol(s)) to allow expansion ofinput/output devices into any vehicle compartment. Since theinput/output node supports multiple communications protocols, a newinput/output device can be introduced to the T2 (or T3) network withoutchanging the architecture.

The T3 network of an unmanned system can provide bandwidth andinterruptible power to payload systems, where the T2 and T3 networks canbe nearly identical electrically, but the priority of the T2 network canbe higher than the T3 network and the T3 network can be isolated fromthe rest of the unmanned system. This allows for information related topayloads, such as video, and controls of the devices, such ascamera/imaging system position, to be managed in a way that does notinterfere with safe and secure operation of the unmanned system.

The herein-described architecture enables quick resolution of power,communications, and computing issues of an unmanned system. Theherein-described architecture also speeds deployment, increase quality,and reduces cost of new unmanned systems, as the herein-describedarchitecture specifies use of reusable architectural components,including a single physical computer, power modules, and input/outputnodes, connected by the mixed-criticality communications network. Then,these architectural components can be designed, implemented, tested, andverified in a modular fashion, thereby enabling deployment of reliablenew vehicles in a cost effective and timely manner; i.e., once verified,an architectural component can be readily introduced into as a reliablebuilding block of a new unmanned system. The mixed-criticalitycommunications network can be expanded to provide bandwidth to newpayload (and other) components. These new components readily can beintegrated to address faults and/or end of life issues of oldercomponents.

Hardware systems based on these reusable architectural components can bereconfigured to meet specific needs of a (new) unmanned system. The useof multiple tiers of communications and multiple power domains enablecustomized power, bandwidth, and fault management for each of a numberof different networks of components within an unmanned system. Thus, theherein-described architecture can provide reliable power, bandwidth, andcomputing services for a variety of unmanned system platforms whilesaving size, weight, power, and costs over related legacy systems.Further, as the architectural components are reusable, operators of newunmanned system that use the herein-described architecture will requireless training to learn about these new unmanned systems.

FIG. 1 is a diagram of an unmanned system (UMS) 100, according to anexample embodiment. As indicated by FIG. 1, one example unmanned system100 is an aircraft. Other example systems that could utilize thearchitecture illustrated by the diagram of FIG. 1 include, but are notlimited to, unmanned and perhaps manned systems that include vehiclesand related support systems including but not limited to, fixed-wingaircraft, aircraft with rotors (e.g., quadcopters, helicopters), groundsupport systems for aircraft, land-based vehicles, surface-watervehicles, and underwater vehicles.

Unmanned system 100 includes battery 112, propulsion module (PrM) 114,tethered power source (TPS) 116, one or more tier one (T1) power modules(PMs) 118, one or more tier two (T2) power modules 120, one or more tierthree (T3) power modules 122, power fault logic (PFL) 130, physicalcomputer 140, network switch 142, one or more input/output nodes (IONs)144 that are in T2, one or more input/output nodes (IONs) 146 that arein T3, core UMS systems 150, auxiliary UMS systems 160, and payloadsystems 170, which are interconnected by communications lines or links(shown using dashed lines in FIGS. 1 and 2) and power lines (shown usingsolid lines in FIGS. 1 and 2). The power lines include utilityconnectors 180, 182 for power domain 1 and T1, utility connector 184 forpower domain 2 and T2, and utility connector 186 for power domain 3 andT3. In some examples, utility connectors from different criticalitydomains can be combined into a single physical interface

Core UMS systems 150 include components that provide core functionalityof unmanned system 100, such as controlled movement operations. Failureof core UMS systems 150 could result in a catastrophic condition forunmanned system 100. In an example where unmanned system 100 includes anaircraft system, a catastrophic condition would prevent continued safeflight and/or prevent a successful emergency landing, which can bereferred to as Uncontrolled Flight into Terrain (UFIT). In exampleswhere unmanned system 100 does not include an aircraft system, acatastrophic condition is a condition that may result in a fatality.

For example, core UMS systems 150 can include autopilot 152, one or morecontrol servos 154, and one or more avionic sensors 156. Controlservo(s) 154 can include one or more servos for moving control surfacesof unmanned system 100. In the example where unmanned system 100 is anaircraft, the control surfaces can include but are not limited toailerons, elevators of horizontal stabilizer, rudders, and flaps.Avionic sensor(s) 156 can include, but are not limited to, one or moresensors for determining airspeed, pitch, pitch rate, roll, roll rate,yaw, yaw rate, acceleration, and/or inertial navigation. In otherexamples, core UMS systems 150 can include more, fewer, and/or differentcomponents.

Auxiliary UMS systems 160 can include components whose functionality isauxiliary to core UMS systems 150 and/or provide other functionalitythan core functionality for unmanned system 100. In a particularaircraft example, T2, power domain 2, and/or auxiliary UMS systems 160can include sensors, computers and signals used for: fixing aircraftposition other than inertial dead reckoning, aircraft navigation andanti-collision lighting systems, aircraft Air Traffic Control (ATC)transponder, one or more C2 data links, health and status monitoring ofaircraft equipment, propulsion systems (assumes control glide landing onbattery power), and/or rejection of operator inputs that exceed safelimits.

For example, auxiliary UMS systems 160 can include including remotecontrol interface 162, one or more lighting systems 164, and one or moretransponders 166. Remote control interface 162 can be used transmittingand/or receiving C2 communications, such as C2 messages and/or commandsprovided by a remote operator of unmanned system 100. For example, C2messages and/or commands can be acted upon by unmanned system 100 ascontrol messages for remotely controlling unmanned system 100. Lightingsystem(s) 164 can include one or more illumination sources forilluminating or lighting part or all of unmanned systems 100. In anexample where unmanned system 100 is an aircraft, lighting system(s) 164can provide illumination for wings and other aspects of the aircraft.Transponder(s) 166 can receive radio signals and automatically transmitdifferent radio signals, such as one or more transponders forcommunicating with air traffic control systems. In other examples,auxiliary UMS systems 160 can include more, fewer, and/or differentcomponents.

Failure of auxiliary UMS systems 160 could result in a hazardouscondition. In this example, a hazardous condition is a condition relatedto a reduction in safety margin, increased operator workload due tocontingency procedures, or a loss of integral platform functionalcapabilities that are not expected to result in a fatality. In anexample where unmanned system 100 includes an aircraft system, ahazardous condition may prevent a normal landing operation, but a forcedemergency landing and/or a collision in a known location is the expectedoutcome from the failure, which can be referred to as Controlled Flightinto Terrain (CFIT) event. For examples where unmanned system 100 doesnot include an aircraft, a hazardous condition may result in the totaleconomic loss of unmanned system 100, but a fatality is not reasonablyexpected to occur due to the hazardous condition. In some examples,non-payload devices in the T2 network/power domain 2 can be configuredto be either in the T2 network/power domain 2 or in the T3 network/powerdomain 3.

Payload systems 170 collectively can be carried by unmanned system 100as a cargo or payload. For example, payload systems 170 can includepayload devices 172, payload sensors 174, and payload communications176. Payload devices 172 can include one or more devices carried aboardunmanned system 100 that are not core or auxiliary UMS systems. Payloadsensor(s) 174 can include one or more sensors configured to measureconditions in an environment around unmanned system 100 and provide dataabout the measured conditions of the environment. Payload communications176 can include one or more devices used for communicating data andperhaps control messages with payload systems 170; e.g., provide uplinkand/or downlink data for communicating with payload systems 170 andperhaps other components of unmanned system 100; e.g., communicatingwith input/output node(s) and/or physical computer 140. In otherexamples, payload systems 170 can include more, fewer, and/or differentcomponents.

The data provided by payload sensor(s) 174 can include, but are notlimited to: meteorological conditions including, but not limited to,wind speed, wind direction, temperature, humidity, barometric pressure,and/or rainfall; location data including, but not limited to, latitude,longitude, and/or altitude data; kinematic information (e.g., location,speed, velocity, acceleration data) related to physical computer 140and/or network switch 142, one or more vehicles, and/or one or moreaircraft, and electromagnetic radiation data (e.g., infra-red,ultraviolet, X-ray data). Payload sensor(s) 174 can include, but are notlimited to, one or more: GPS sensors, location sensors, gyroscopes,accelerometers, magnetometers, video and/or still cameras/imagingsystems, light sensors, infrared sensors, ultraviolet sensors, X-raysensors, meteorological sensors, proximity sensors, vibration and/ormotion sensors, heat sensors, thermometers, lasers, wind sensors,barometers, rain gauges, and microphones. In some examples, payloadsensor(s) 174 can be utilized for relative position sensing, whererelative position sensing provides information about aircraft velocityrelative to a vehicle; e.g., using differential GPS and/or radio-basedtriangulation methods.

For examples where unmanned system 100 includes an aircraft, a T3failure may result in an aborted sortie if payload activity is thepurpose of the flight, but a normal landing at a normal base ofoperations is the expected result. For examples where unmanned system100 does not include an aircraft, a T3 failure may result in loss offunctionality disabling the system, but injury or total economic loss ofthe system is not expected.

In a particular aircraft example, T3, power domain 3, and/or payloadsystems 170 can include equipment, signals and commands used for modularpayloads not required for aircraft flight including but not limited to:gimbals for positioning and stabilizing payloads, optical and infraredimage capturing equipment, computers for payload stabilization, trackingalgorithms and metadata tagging, transceivers for Payload Data Link withsystems not on the aircraft, transceivers for ground-to-ground orair-to-ground communications relay, and other data gathering electronicequipment.

The architecture of unmanned system 100 is divided into three tiers withthree related power domains, where a tier refers tocommunications/networking of a “network” or groups of components withinunmanned system 100, and where a power domain refers to power providedto and/or received from a network of components within unmanned system100. For example, FIG. 1 shows that a tier 1 (T1) and associated powerdomain 1 can respectively provide communications and power for a “T1network” of components that include core UMS systems 150, a tier 2 andassociated power domain 2 can respectively provide communications andpower for a “T2 network” of components that include auxiliary UMSsystems 160, and a tier 3 and associated power domain 3 can respectivelyprovide communications and power for a “T3 network” of components thatinclude payload systems 170.

The T1 network can provide guaranteed bandwidth and uninterruptablepower to core UMS systems 150. In the example of unmanned system 100being an unmanned aircraft, the core UMS systems 150 can includeautopilot 152, one or more control servos 154 that can be used to movecontrol surfaces of the unmanned aircraft, and one or more avionicssensors 156. Then, position and stability controls for the unmannedaircraft are only communicated within the T1 network, thereby ensuringthat C2 operations are guaranteed sufficient bandwidth, even whenauxiliary UMS systems 160 and/or payload systems 170 utilize a greatdeal of bandwidth. In this example, core UMS systems 150 enable theunmanned aircraft to perform (albeit in a possibly degraded fashion) inthe presence of faults in the auxiliary unmanned vehicle systems and/orthe payload systems. In this example, the unmanned aircraft can haveremote control interface 162, such as a radio, for a human controller toprovide C2 commands to direct the unmanned aircraft—then, core UMSsystems 150 can enable the unmanned aircraft to maintain safe and stableoperations with predetermined basic navigation even if remote controlinterface 162 fails. Also, physical computer 140 and/or network switch142 can recognize a loss of communications via remote control interface162 and can execute emergency procedures to insure safe operation untilremote control interface 162 is reestablished. In this way, the unmannedaircraft can run self-diagnostics in the T2 network while independentlymaintaining safe operation of the vehicle in the T1 network. Usingpre-programmed navigation data, physical computer 140 can use theemergency procedures to direct the unmanned aircraft in a predeterminedmanner (e.g., to fly at a predetermined altitude, speed and/or velocity;to fly to a predetermined location) without human intervention/error.

Some avionic sensor(s) 156 connected to the T1 network can includelocation sensors; e.g., GPS systems, that provide continuous ornearly-continuous location positional assessment capabilities. Locationdata determined by the location sensors of avionic sensor(s) 156 canthen be provided to autopilot 152 via the T1 network withoutinterruption. The architecture can be configured so that sensors locatedin the T2 and/or T3 networks can provide data to the autopilot and/orother core vehicle systems. Power domain 1 associated with the T1network can be powered using battery 112 and perhaps other powersources, such as propulsion module 114 (i.e., an engine) and/or tetheredpower source 116. Battery 112 can automatically take over theresponsibility of keeping the vehicle powered in the event of criticalpower faults, such as failure of propulsion module 114 and/orovercurrent faults in the T2 and/or T3 networks. Then, the power systemproviding power domain 1 can detect the critical power faults andresponsively switch off unnecessary power loads instantaneously, both tosave power and to protect components of the T1 network.

The T2 network and power domain 2 can respectively provide bandwidth andinterruptible power to auxiliary UMS systems 160. Continuing theunmanned aircraft example mentioned in the context of the T1 network andpower domain 1, the T2 network can include remote control interface 162,one or more lighting systems 164, one or more transponders 166,propulsion module 114, tethered power source 116, and perhaps othernon-payload systems of the unmanned aircraft. In this example, the T2network can route communication of C2 commands provided using the remotecontrol interface to the T1 network without interference of othercommunications on the T1 network. Also, the T2 network can be designedto be isolated from the T3 network, so communications within the T2network (e.g., C2 messages and/or commands) can be unperturbed bycommunications within the T3 network (e.g., payload-related messages).

Communications in the T2 and/or T3 networks can be tagged with qualityof service (QoS) information that enables network switch 142 to routethe QoS-tagged communications and provide bandwidth control related tothe QoS-tagged communications of the T2 and/or T3 networks. Input/outputnodes 144, 146 can be connected to the T2 network and T3 networkrespectively via Ethernet (or perhaps other communication protocol(s))to allow expansion of input/output devices into any vehicle compartment.

The T3 network and power domain 3 of unmanned system 100 canrespectively provide bandwidth and interruptible power to payloadsystems 170. The T2 and T3 networks can be nearly identicalelectrically, but the priority of the T2 network can be higher than theT3 network and the T3 network can be logically separated from the restof unmanned system 100. Logically separated of the T3 network allows forinformation related to payloads, such as video, and controls of thedevices, such as camera/imaging system position, to be managed in a waythat does not interfere with safe and secure operation of the unmannedsystem.

More generally, physical computer 140 and/or network switch 142 canlogically separate the T1, T2, and/or T3 networks. For example, the T2network can have a T2 traffic threshold and the T3 network can have a T3traffic threshold. Then, physical computer 140 and/or network switch 142can monitor an amount of message traffic on at least the T2 (and/or T3)network(s) and if message traffic on the T2 (and/or T3) network(s)exceeds the T2 (and/or T3) traffic threshold(s), physical computer 140and/or network switch 142 can restrict and/or block some or all messagetraffic on the T2 (and/or T3) network(s) until the amount of messagetraffic on at least the T2 (and/or T3) network(s) no longer exceeds theT2 (and/or T3) traffic threshold(s).

In some examples, one or more communication tiers can have multipletypes of message traffic; e.g., T3 can have message traffic related topayload controls, and payload data, such as message traffic relatedvideo data and of message traffic related to non-video data. In theseexamples, physical computer 140 and/or network switch 142 can monitor anamount of each type of message traffic on the communication tier(s) thathave multiple types of message traffic. Also, physical computer 140and/or network switch 142 can maintain a per-message-type trafficthreshold for the communication tier(s) that have multiple types ofmessage traffic; e.g., a first threshold for T3 payload control messagetraffic, a second threshold for T3 video data message traffic, and athird threshold for T3 non-video data message traffic. Then, if messagetraffic on communication tier(s) that have multiple types of messagetraffic exceeds one or more per-message-type traffic thresholds,physical computer 140 and/or network switch 142 can restrict and/orblock some or all message traffic having the type(s) of message trafficthat have exceeded respective per-message-type traffic thresholds untilthe amount of message traffic on communication tier(s) that havemultiple types of message traffic no longer exceeds the respectiveper-message-type traffic thresholds. For example, if payload sensors 174are generating and sending video data messages at a rate that exceedsthe second threshold, then physical computer 140 and/or network switch142 can restrict and/or block video data message traffic in T3 untilpayload sensors 174 send video data messages at a rate that no longerexceeds the second threshold. Other types of thresholds and/or logicalseparation of communications networks/tiers by unmanned system 100 arepossible as well.

A power system of unmanned system 100 can include aspects of powerdomains 1, 2, and 3 that provide, distribute, and/or manage electricalpower of unmanned system 100. For example, FIG. 1 shows that a powersystem of unmanned system 100 can include power sources that includebattery 112, propulsion module 114 and tethered power source 116, powermodules that include T1 power module(s) 118, T2 power module(s) 120, andT3 power module(s) 122, and power fault logic 130 interconnected bypower lines that include utility connectors 180, 182, 184. In someexamples, physical computer 140 and/or one or more input/output nodes(e.g., input/output node(s) 144 in T2) can act as part of the powersystem of unmanned system 100 (e.g., provide controls, fault processing,and/or signals, related to electrical power of unmanned system 100).

In some examples, the power system can have one more power sources thatcan provide a predetermined amount of power (e.g., 250 watts) and at apredetermined voltage (e.g., 28 V). For example, power sources ofunmanned system 100 include battery 112, propulsion module 114, andtethered power source 116. In some examples, the power system can complywith one or more standards related to power quality requirements; e.g.,a MIL-STD-704F standard. In some examples, some or all of battery 112,propulsion module 114, and tethered power source 116 can provide thepredetermined amount of power at the predetermined voltage and/or cancomply with one or more standards related to power quality requirements.

Battery 112 can provide storage of electrical power that can bedelivered at a predetermined voltage (e.g., 12V, 24V, 28V). Propulsionmodule 114 can provide electrical power and propulsion of unmannedsystem 100. Tethered power source 116 can provide electrical power froma power source external to unmanned system 100 (e.g., a generator, apower grid). In some examples, battery 112 can be charged fromelectrical power provided by propulsion module 114 and/or tethered powersource 116.

In some examples, battery 112 can store and deliver adequateinstantaneous power to maintain uninterrupted power functionalitythroughout power domain 1, even after an overcurrent event resulting inshut down of power domain 2 and/or power domain 3. In examples whereunmanned system 100 is an aircraft, battery 112 can store and deliveradequate instantaneous power to maintain uninterrupted powerfunctionality throughout power domain 1 to allow unmanned system 100 toland from a predetermined maximum altitude.

Each of the three tiers and power domains can represent a criticalitycategory or severity of a potential failure within the tier or powerdomain. For example, T1 and power domain 1 can support the most criticalcomponents (core UMS systems 150) of unmanned system 100 and so can beassigned to a high criticality category; T2 and power domain 2 cansupport somewhat critical components (auxiliary UMS systems 160) ofunmanned system 100 and so can be assigned to a medium criticalitycategory; and T3 and power domain 3 can support less critical components(payload systems 170) of unmanned system 100 and can be assigned to alow criticality category. Other criticality categories are possible aswell.

A power module can supply power to part or all of a power domain,isolate a higher-numbered power domain from a lower-numbered powerdomain, and can sense power provided to electrical loads associated withthe power module. In the example illustrated in FIG. 1, T1 powermodule(s) 118 can provide power at least from one or more ofabove-mentioned power sources (battery 112, propulsion module 114,tethered power source 116) and sense the power provided to electricalloads in power domain 1, T2 power module(s) 120 can provide power atleast from one or more of above-mentioned power sources and sense thepower provided to electrical loads in power domain 2, and T3 powermodule(s) 122 can provide power at least from one or more ofabove-mentioned power sources and sense the power provided to electricalloads in power domain 3. Regarding power sensing, a power module cansense voltage and current delivered to electrical loads connected to thepower module; in some examples, the power module can sense voltage andcurrent independently for each connected electrical load. Also, T2 powermodule(s) 120 can act, perhaps in conjunction with T1 power module(s)118, to isolate power domain 2 from power domain 1. Further, T3 powermodule(s) 122 can act, perhaps in conjunction with T1 power module(s)118 and/or T2 power module(s) 120, to isolate power domain 3 from powerdomain 1 and power domain 2. Additional features of power modules arediscussed further herein; e.g., in the context of power module 200 andFIG. 2.

Power domain 1 can provide uninterruptible power to the devices in theT1 network (or T1 devices, for short). Uninterruptible power isconsidered to power provided to a device D when device D is protectedfrom single point failures in the power system so that device Dcontinues to receive power after occurrence of such single pointfailures.

T1 devices can connect to power domain 1 directly; that is, no inputcurrent limit devices or circuit breakers have to be employed forconnecting T1 devices to power domain 1. In aircraft examples ofunmanned system 100, an autopilot, such as autopilot 152, can be anon-redundant T1 device attached directly to power domain 1; e.g., viautility connector 182. In some examples, a T1 device can connect topower domain 1 using a voltage regulator. In some examples, utilityconnector 182 for power domain 1 can support at least a predeterminedpercentage (e.g., 150%, 200%, 225%) of expected power provided by powersources of unmanned system 100 (e.g., battery 112, propulsion module114, tethered power source 116), where the predetermined percentage isgreater than 100%. In some examples, communications links enablingcommunication between components of the T1 network can support at leasta predetermined percentage (e.g., 200%, 300%, 512%) of expectedbandwidth, where the predetermined percentage is greater than 100%.

Some T1 devices can be redundant devices; that is, if one of a group ofredundant devices fails and at least one device in the group ofredundant devices remains active, then the active redundant device(s) inthe group of redundant devices can at least partially carry out thefunctions of the failed redundant device. As an example, a group ofservomechanisms can act as a group of redundant devices to perform thefunctionality of control servo(s) 154 to move control surfaces ofunmanned system 100; e.g., to move inner and outer wing surfaces of anaircraft. Then, if a group of redundant devices are connected to powerdomain 1, power domain 1 can include power fault protection features sothat a short-to-ground fault at one of the group of redundant devicesdoes not negatively impact the power delivered to the rest of the groupof redundant devices.

The power system can provide “criticality firewalls” or power protectiondevices, including but not limited to, power modules 118, 120, 122,power fault logic (PFL) 130, circuit breakers, current limiters, andvoltage regulators, to prevent any single overcurrent fault on a highernumbered power domain from negatively impacting operations of a lowernumbered power domain higher criticality circuit net. For example, thepower system can prevent a single overcurrent fault in power domain 2from negatively impacting operations of power domain 1, but power domain3 may be negatively affected by the single overcurrent fault in powerdomain 2.

A criticality firewall can operate autonomously and automatically (thatis, without software interaction, with a possible exception forconfiguring data of the criticality firewall) that is sized forworst-case loads and not respond to harmless transients loads. Thecriticality of a criticality firewall is equal to the highestcriticality system (i.e., lowest number tier and/or power domain) thatit touches, since failure of the criticality firewall could expose ahigher-criticality system to a fault in the lower-criticality system.For example a circuit breaker acting as a criticality firewallconnecting T1 power to a T3 load protects T1 power and is therefore a T1criticality firewall. In some examples, a power domain can bepartitioned using criticality firewalls to contain the impact ofpotential faults; e.g., power domain 2 can be partitioned usingcriticality firewalls to protect individual components of the T2network, such as separately protecting remote control interface 162,lighting systems 164, and transponders 166 using criticality firewalls

The power system of unmanned system 100 can protect a malfunction of onepower source, such as one of battery 112, propulsion module 114,tethered power source 116, from causing malfunctions on another powersource. In an example of unmanned system 100 as depicted in FIG. 1, thepower system of unmanned system 100 can protect a malfunction inpropulsion module 114's ability to provide electrical power from causingelectrical damage to either battery 112 or tethered power source 116. Ifone power source fails (e.g., due to malfunction), power module 200 candetect the failure using current and voltage sensors 244 and signal thefailure so that the power system can responsively switch to anotherworking power source.

In some examples, switching between power sources can occursubstantially instantaneously; e.g., within a power-switching thresholdof time, such 20 microseconds, 100 microseconds, 500 microseconds, 1000microseconds, 2500 microseconds, or 10000 microseconds. In someexamples, tethered power source 116 and/or propulsion module 114 can bedisconnected by the power system when a reverse polarity voltage or anovervoltage condition is detected for tethered power source 116 and/orpropulsion module 114.

Power fault logic 130 can receive and store data about power-faultrelated signals, so that input/output node 144 can retrieve the dataabout power-fault related signals, and provide data about thepower-fault related signals to physical computer 140 for softwareprocessing. Table 1 below provides example functionality that can beprovided by power fault logic (e.g., power fault logic 130 and perhapsother components) of the power system of unmanned system 100.

TABLE 1 Payload Information Delivered Power Off Source to Power FaultLogic Signal 214 Connection 130 and Input/Output Detected Fault ActionAction Node 144 Overvoltage or Switch to valid Disconnect Propulsionmodule 114 reverse voltage for power source propulsion disconnect statedata power from module 114 until propulsion module power cycle or 114reset by input/output node 144 Overvoltage or Switch to valid DisconnectTethered power source reverse voltage for power source tethered power116 disconnect state data power from tethered source 116 until powersource 116 power cycle or reset by input/output node 144 Overcurrent forAssert payload Leave propulsion Propulsion module 114 power from poweroff module 114 overcurrent fault data propulsion module signal 214connected 114 Overcurrent for Assert payload Leave tethered Tetheredpower source power from tethered power off power source 116 116overcurrent fault power source 116 signal 214 connected dataUndervoltage for Switch to valid Switch to valid Low voltage data (forpower from power source power source detection by input/outputpropulsion module node 144). 114 Undervoltage for Switch to valid Switchto next- Low voltage data (for power from tethered power source lowestvoltage detection by input/output power source 116 source node 144). Useof battery 112 Assert payload N/A Assert power off signal 214

As indicated by Table 1 above, an undervoltage fault event or anovervoltage fault event can cause disconnection of a power source; e.g.,undervoltage or overvoltage from power provided by either propulsionmodule 114 or tethered power source 116.

In some embodiments, a power module (e.g., T2 power module(s) 120, T3power module(s) 122) and/or an input/output node (e.g., input/outputnode 144 operating in the T2 network, input/output node 146 operating inthe T3 network) can subsequently reconnect a previously-disconnectedpower source after a fault event condition has cleared. As alsoindicated by Table 1 above, overcurrent fault events do not causedisconnection of power sources; rather, overcurrent fault events cancause assertion of payload power off signal 214.

The power system of unmanned system 100 can have a user interface (notdepicted in FIG. 1) that can be used to signal faults, powerinterruptions, power source malfunctions, and other failure conditions;e.g., using one or more alarm indications. Then, the user interface candisplay and/or otherwise provide the alarm indications to an operator,technician, or other user having access to the user interface. The userinterface also can have functionality to enable a user to controlconnections of electrical loads in unmanned system 100 following one ormore signal faults, power interruptions, power source malfunctions,and/or other failure conditions.

In other examples, more, fewer, and/or different tiers, power domains,and/or criticality categories can be utilized by unmanned system 100. Asa more specific example, unmanned system 100 can include a tier 4 andrelated power domain 4 that includes a “T4 network” of components thatprovide one or more training and/or simulation capabilities and/or caninclude a tier 5 and related power domain 5 that includes a “T5 network”of components that provide one or more maintenance, diagnostic, and/ortrouble shooting capabilities.

Components within unmanned system 100 can be connected and powered viautility connectors or unique item connectors, whichever is convenientfor space constraints. As such, utility connectors can provideflexibility to reuse equipment in a variety of platforms or locationswithin a single platform. Unique connectors can be point optimized forexact pinouts and minimum size and weight.

FIG. 2 is a block diagram of a portion of the power system of unmannedsystem 100, according to an example embodiment. The portion of the powersystem of unmanned system 100 illustrated in FIG. 2 includes powermodule 200, power fault logic 130, and power sources including battery112, propulsion module 114, and tethered power source 116 interconnectedby communications lines or links (shown using dashed lines in FIGS. 1and 2) and power lines (shown using solid lines in FIGS. 1 and 2).

Power module 200 is a programmable circuit block capable of providingcurrent sensing, circuit breaker functionality, circuit breaker resetfunctionality, controllable power enable/disable functionality,criticality firewall functionality, and state reporting functionality.In some examples, one power module 200 can perform some or all of thetasks of any one of power modules 118, 120, 122. For example, whenperforming as one of T1 power module(s) 118, power module 200 canprovide uninterruptable, high quality power for power domain 1/forcomponents of the T1 network and can protect components of the T1network from one or more electrical faults; e.g. overcurrent faults.When performing as one of power module(s) 120 or power module(s) 122,power module 200 can provide high quality power for power domain 2 orpower domain 3, respectively and can act as a criticality firewall toprotect a lower-numbered power domain; e.g., while performing as one ofpower module(s) 120 in power domain 2, the power module can act as acriticality firewall to protect a power domain 1 from power faults;e.g., overcurrent faults.

Power module 200 includes power switch 240, circuit breaker 242, currentand voltage sensors 244, and mode indicator 246. Power switch 240includes a controllable switch that can be switched either to allow orto interrupt power flow through power module 200; e.g., power flow frominput power 210 to output power 230. In some examples, upon reception ofa power enable signal; e.g., power enable signal 212, power flow throughpower module 200 can be enabled.

In some examples, power module 200 can include data for an adjustablethreshold OverCurrThresh that indicates a percentage of maximumallowable power detected by circuit breaker 242 of power module 200before asserting an overcurrent fault. For example, the thresholdOverCurrThresh can be adjusted to a value between 0 and 100% of maximumallowable power supported by a utility connector (e.g., utilityconnector 184 for the T2 network). If circuit breaker 242 detects thatinput power 210 exceeds OverCurrThresh then power module 200 can signalthat an overcurrent fault has been detected. In some examples,OverCurrThresh can be set to one of a maximum number of threshold levelvalues; e.g., the maximum number of threshold level values can be 2, 10,16, 32, 64, 100, 128, 256, or a larger number.

Circuit breaker 242 includes one or more devices (e.g., circuitbreakers, fuses) for stopping power flow through power module 200 as asafety measure; e.g., stopping power flow through power module 200 incase of an overcurrent fault and/or one or more other faults detected bypower module 200. In usual operation, circuit breaker 242 stays in abreaker-closed state where circuit breaker 242 allows power flow throughpower module 200 until a fault is detected. When circuit breaker 242detects a fault, circuit breaker 242 can be set or changed from thebreaker-closed state to a breaker-open state where circuit breaker 242stops power flow through power module 200. After circuit breaker 242 isset to the breaker-open state, circuit breaker 242 can receive a resetsignal; e.g., breaker reset signal 218. After reception of the resetsignal, circuit breaker 242 can be reset or changed from thebreaker-open state to the breaker-closed state. However, a subsequentovercurrent fault detected by circuit breaker 242 can cause circuitbreaker 242 to again be set to the breaker-open state; i.e., the resetsignal does not override fault protection capabilities leading tostopping power flow.

Power module 200 can use current and voltage sensors 244 to sense ordetect voltage and current delivered to electrical loads connected topower module 200. Current and voltage sensors 244 can include voltagesensors, current sensors, and/or other electrical sensors to measurecurrent, voltage, and perhaps other characteristics of power flowthrough power module 200 and provide data related to the measuredcurrent, voltage, and perhaps other characteristics of power as currentand/or voltage sense signals 232.

For example, power module 200 can use current and voltage sensors 244 todetermine a current and/or a voltage related to power provided by eachpower source of unmanned system 100. Then, a power source providingpower at a predetermined voltage (e.g., 28 V) and/or at a predeterminedcurrent, perhaps within a predetermined range of voltages and/or withina predetermined range of currents, can be considered a valid powersource. However, a power source providing power at a different voltageand/or current than the predetermined voltage and/or current (or outsideof the predetermined range of voltages and/or the predetermined range ofcurrents) can be considered an invalid power source. Then, power module200 can switch as necessary from obtaining power from an invalid powersource to obtaining power only from a valid power source.

As another example, the data related to the measured current provided incurrent and/or voltage sense signals 232 can include a signalproportional to the sensed current through the circuit, where the signalcan range from a minimum voltage or current value to represent a minimumpercentage of expected current to a maximum voltage or current value torepresent a maximum percentage of expected current; e.g., a minimumvoltage of 0 V or a minimum current of 4 milli-amperes (mA) representinga minimum percentage of expected current of 0%, and a maximum voltage of3 V or a maximum current of 20 mA representing a maximum percentage ofexpected current of 150%. Other minimum voltage, maximum voltage,minimum current, maximum current, minimum percentage of expectedcurrent, and/or maximum percentage of expected current values arepossible as well.

As another example, current and voltage sensors 244 can provide currentand/or voltage sense signals 232 that include data related to themeasured voltage, where the data can include a signal proportional tothe sensed voltage through the circuit. The signal proportional to thesensed voltage can range from a minimum voltage (or current) value torepresent a minimum percentage of expected voltage to a maximum currentvalue to represent a maximum percentage of expected voltage; e.g., aminimum voltage of 0 V or a minimum current of 4 mA representing aminimum percentage of expected voltage of 0%, and a maximum voltage of 3V or a maximum current of 20 mA representing a maximum percentage ofexpected voltage of 125%. Other minimum current, maximum current,minimum voltage, maximum voltage, minimum percentage of expectedvoltage, and/or maximum percentage of expected voltage values arepossible as well.

In some examples, power module 200 can provide current and/or voltagesense signals 232 as analog and/or digital information to aherein-described input/output node. Then, the input/output node canconvert the analog information to digital information, packetize thedigital information (both digital information as received and asconverted), and communicate the resulting packets of digitalinformation; e.g., to physical computer 140.

Mode indicator 246 is a programmable indicator that stores mode data forpower module 200, where the mode data can be provided usingconfiguration data input 220. The mode data can indicate an operatingmode of power module 200 related to a power domain where power module isbeing used. For example, the mode data can indicate that power module200 is in one of three operating modes: an operating mode of “S” or “T1”for power module 200 operating in power domain 1 for the T1 network, anoperating mode of “B” or “T2” for power module 200 operating in powerdomain 2 for the T2 network, or an operating mode of “P” or “T3” can beused for power module 200 operating in power domain 3 for the T3network. Other operating modes and/or mode data are possible as well. Inexamples where unmanned system 100 is an aircraft, mode indicator 246and/or other data related to the power system may have an interlock thatinhibits changing of mode indicator 246 and/or other data related to thepower system in flight.

FIG. 2 illustrates that power module 200 can receive one or more inputsand provide one or more outputs. For example, the inputs to power module200 can include input power 210, power enable signal 212, payload poweroff signal 214, payload power off override signal 216, breaker resetsignal 218, and configuration data input 220. And, in this example, theoutputs of power module 200 can include output power 230, current and/orvoltage sense signals 232, and breaker state signal 234. In a moreparticular example, input power 210 can be uninterruptable powerprovided at 28 V, output power 230 can be interruptible power providedat 28 V, power enable signal 212 can be a digital signal indicatingwhether power should be output by power module 200, payload power offsignal 214 can be a digital signal indicating whether power should beoutput by power module 200 to T3 components/components in power domain3, payload power off override signal 214 can be a digital signalindicating whether power should be output by power module 200 to T3components/components in power domain 3 even if payload power off signal214 is active, configuration data input 220 can be a digital signalproviding mode data and/or other data used for configuring power module200, current and/or voltage sense signals 232 can be digital and/oranalog signals indicating current, voltage, and/or other characteristicsof power provided to one or more electrical loads connected to powermodule 200, and breaker state signal 234 can be a digital signalindicating a state (e.g., breaker-open or breaker-closed) state ofcircuit breaker 242. More, fewer, and/or different inputs and/or outputsto and/or from power module 200 are possible as well.

In some examples, some of the inputs shown in FIG. 2 can be ignoredbased on an operating mode of power module 200. For example, a powermodule operating in the “S” or “T1” operating mode can ignore powerenable signal 212, payload power off signal 214, payload power offoverride signal 216, and breaker reset signal 218. As another example, apower module operating in the “B” or “T2” operating mode can ignorepayload power off signal 214 and payload power off override signal 216.Continuing this example, a power module operating in the “P” or “T3”operating mode may not ignore any inputs, including power enable signal212, payload power off signal 214, payload power off override signal216, and breaker reset signal 218.

In some examples, electrical loads (such as auxiliary UMS systems 160)can be attached to power domain 2 only by way of a power moduleoperating with the “B” or “T2” operating mode; e.g., each of powermodule(s) 120 can have mode data of mode indicator 246 indicating the“B” or “T2” operating mode. In related examples, electrical loads (suchas payload systems 170) can be attached to power domain 3 only by way ofa power module operating with the “P” or “T3” operating mode; e.g., eachof power module(s) 122 can have mode data of mode indicator 246indicating the “P” or “T3” operating mode. In other related examples, apower connection to a component of the T1 network that also connects tocomponent(s) of the T2 and/or T3 networks can be attached to the powersystem only by way of a power module operating with the “S” or “T1”operating mode; e.g., each of T1 power module(s) 118 can have mode dataof mode indicator 246 indicating the “S” or “T1” operating mode.

In some examples, reception of payload power off signal 214 can causepower module 200 to stop power flow through power module 200. However,payload power off signal 214 can be ignored (i.e., power can flowthrough power module 200) upon reception of payload power off overridesignal 216 even if payload power off signal 214 is still being provided.However, payload power off override signal 216 does not inhibit stoppageof power flow through power module 200 if circuit breaker 242 detects afault and therefore is in the breaker-open state.

Power fault logic 130 can include logic circuitry, software, and/orother circuitry to store and signal faults within the power system ofunmanned system 100. Signaling of faults can include, but is not limitedto payload power off signal 214, payload power off override signal 216,and/or breaker reset signal 218. In particular, power fault logic cansignal payload power off signal 214 upon detection of one or more of thefollowing conditions: an overcurrent condition for electrical powerprovided from propulsion module 114, an overcurrent condition forelectrical power provided from propulsion module 114, tethered powersource 116, a condition where battery 112 is providing electrical powerfor the power system, or a condition where a virtual computer for the T2network is being reset. Other conditions for signaling payload power offsignal 214 are possible as well.

Power fault logic 130 can also store fault information in fault statusstorage 260. Fault status storage 260 can record a status of faultevents/fault conditions in the power system of unmanned system 100. Forexample, fault status storage can include one or more latches or otherstorage devices to store status (e.g., asserted or de-asserted) of oneor more fault-related signals, including but not limited to, payloadpower off signal 214, battery on signal 250, propulsion module (PrM)fault signal 252, and tethered power system (TPS) fault signal 254. Insome examples, power module 200 and/or an input/output node (e.g.,input/output node 144 operating in the T2 network) can read the faultinformation stored in fault status storage 260 to determine currentfault conditions (if any) present within the power system of unmannedsystem 100. In some examples, some or all of the status data in faultstatus storage 260 can be remotely reset or cleared to indicate ade-asserted status; e.g., to clear stored fault condition data once oneor more fault conditions have been corrected.

Power module 200 can be controlled by an external device ED, such asphysical computer 140 and/or an input/output node, such as one or moreof input/output nodes 144, 146. Such controls can depend on theoperating mode of power module 200. For example, if power module 200 isoperating with the “P” or “T3” operating mode, current and voltagesensors 244 can sense current, voltage, and/or other electricalcharacteristics of power provided to ED, and ED enable or disable powermodule 200 from providing output power 230 by respectively asserting orde-asserting power enable signal 212. Also, ED can receive stateinformation about circuit breaker 242 (e.g., breaker-open and/orbreaker-closed state information) by way of breaker state signal 234,and if necessary, reset circuit breaker 242 from a breaker-open state toa breaker-closed state by asserting breaker reset signal 218. ED canalso cause a system wide shut down of the T3 network by assertingpayload power off signal 214. Upon reception of the asserted payloadpower off signal 214, power module 200 can stop providing output power230, regardless of power enable signal 212 and a state of circuitbreaker 242. However, if a particular power module in the T3 network isto continue providing output power even during system wide shut down ofthe T3 network, then ED can assert payload power off override signal 216to cause the particular power module to ignore or override an assertedpayload power off signal 214.

As another example, if power module 200 is operating with the “B” or“T2” operating mode, current and voltage sensors 244 can sense current,voltage, and/or other electrical characteristics of power provided toED, and ED enable or disable power module 200 from providing outputpower 230 by respectively asserting or de-asserting power enable signal212. Also, ED can receive state information about circuit breaker 242(e.g., breaker-open and/or breaker-closed state information) by way ofbreaker state signal 234, and if necessary, reset circuit breaker 242from a breaker-open state to a breaker-closed state by asserting breakerreset signal 218. However, while in the “B” or “T2” operating mode,power module 200 ignores payload power off signal 214 and payload poweroff override signal 216; thus, power module 200 in the “B” or “T2”operating mode, presumably operating in the T2 network, does notparticipate in a system wide shut down of the T3 network.

As another example, if power module 200 is operating with the “S” or“T1” operating mode, current and voltage sensors 244 can sense current,voltage, and/or other electrical characteristics of power provided toED. However, while in the “S” or “T1” operating mode, power module 200ignores power enable signal 212, payload power off signal 214, payloadpower off override signal 216; and breaker reset signal 218, and circuitbreaker 242 may be disabled. Thus, power module 200 in the “S” or “T1”operating mode, presumably operating in the T1 network, only providesand senses uninterruptable power without providing circuit breakercapabilities, controllable power (power on/off) functionality, orparticipating in a system wide shut down of the T3 network.

As indicated above, each operating mode of power module 200 can beassociated with particular set of functions. If power module 200 isoperating with the “S” or “T1” operating mode, current and voltagesensors 244 can use a first set of functions that include a function forproviding input power 210 as output power 230 to an external device EDand a function for sensing output power 230 provided to ED using currentand voltage sensors 244 to generate current and/or voltage sensesignal(s) 232. If power module 200 is operating with the “B” or “T2”operating mode, power module 200 can use a second set of functions thatcan include the first set of functions as well as a circuit breakingfunction using circuit breaker 242 for output power 230 provided for ED,and a power on/off function using power on/off switch 240 triggered atleast by power enable signal 212 for output power 230 provided for ED.If power module 200 is operating with the “P” or “T3” operating mode,power module 200 can use a third set of functions that can include thesecond set of functions as well as a function for powering down apayload (e.g., payload systems 170) using power on/off switch 240triggered at least by payload power off signal 214 and/or payload poweroff override signal 216 in response to a power fault. As such, powermodule 200 can be configured to provide at least all of the third set offunctions, but can provide fewer functions in operation based on theoperating mode.

FIG. 3 is a block diagram of a communications network of unmanned system100, according to an example embodiment. The communications network ofFIG. 3 is closely related to the communications network of FIG.4—differences between the two communications networks are discussedbelow in more detail in the context of FIG. 4.

Both the communications network shown in FIG. 3 and the communicationsnetwork shown in FIG. 4 include physical computer 140, network switch142, core UMS systems 150, auxiliary UMS systems 160, and payloadsystems 170. Generally, physical computer 140 and/or network switch 142can be implemented using any hardware device or system capable ofrunning software/computer-readable instructions that cause the hardwaredevice or system to perform the herein-described functionality ofphysical computer 140 and/or network switch 142. Other components canvary from the illustrative examples shown in FIGS. 3 and 4.

FIG. 3 shows that link 362 carries communications between physicalcomputer 140, auxiliary UMS systems 160, and payload systems 170, wherethese communications are shown in FIG. 3 as respective T2 traffic (T2T)352, 354, 356 and T3 traffic 358, via network switch 142. In otherexamples, a common link can carry T2 traffic 352, 354, 356, and T3traffic 358. Other components can vary from the illustrative examplesshown in FIGS. 3 and 4. Generally, physical computer 140 (or networkswitch 142) can be implemented using any hardware device or systemcapable of running software/computer-readable instructions that causethe hardware device or system to perform the herein-describedfunctionality of physical computer 140 (or network switch 142).

Physical computer 140 includes one or more processors 310, resourcefirewall hardware 314, and data storage 320 linked together via a systembus, network, or other connection mechanism. In some examples, some orall of the herein-described functionality of resource firewall hardware314 is provided by other components of communications network ofunmanned system 100; e.g., by hardware and/or software associated withone or more processors 310 and/or data storage 320.

One or more processors 310 can include multiple cores 312 a, 312 b, 312c . . . 312 d. In some examples, processor(s) 310 can be one multi-coreprocessor with all of cores 312 a, 312 b, 312 c . . . 312 d—then eachcore can be an individual processing unit of the one multi-coreprocessor. In other examples, processor(s) 310 can have multipleprocessors, where each of the multiple processors can either be a singlecore processor or a multi-core processor, and so the multiple processorscan collectively provide cores 312 a, 312 b, 312 c . . . 312 d. As such,each of processor(s) 310 can include one or more of cores 312 a, 312 b,312 c . . . 312 d.

Each of processor(s) 310 and each of cores 312 a, 312 b, 312 c . . . 312d, can include at least one central processing unit, computer processor,mobile processor, digital signal processor (DSP), graphics processingunit (GPU), microprocessor, computer chip, programmable processor,and/or other processing unit configured to execute softwarecomputer-readable instructions, such as software/computer-readableinstructions 322 stored in data storage 320, and process data. That is,each of processor(s) 310 and each of cores 312 a, 312 b, 312 c . . . 312d can be configured to execute software/computer-readable instructions322 and/or other instructions as described herein.

Data storage 320 includes one or more physical and/or non-transitorystorage devices, such as read-only memory (ROM), random access memory(RAM), removable disk drives, hard drives, thumb drives, magnetic-tapememory, optical-disk memory, flash memory, volatile storage devices,non-volatile storage devices, and/or other storage devices. Generally, astorage device includes hardware that is capable of storing information;for example, data, computer-readable program instructions, and/or othersuitable information on a temporary basis and/or a permanent basis. Datastorage 320 can include one or more physical and/or non-transitorystorage devices with at least enough combined storage capacity tocontain software/computer-readable instructions 322 and anyassociated/related data structures. In some embodiments, some or all ofdata storage 320 can be removable, such as a removable hard drive,removable disk, or flash memory.

Along with storage capacity for software/computer-readable instructions322, data storage 320 can include any storage required, respectively, toperform at least part of the herein-described functionality of physicalcomputer 140. Computer-readable instructions 322 can includeinstructions that when executed by processor(s) 310 to performfunctions, including but not limited to herein-described functionalityof software, displays, and/or user interfaces. For example,computer-readable instructions 322 can include instructions that whenexecuted by processor(s) 310, cause physical computer 140 to performsome or all of the herein-described functionality associated with aphysical computer, a hypervisor/hypervisor software, a virtual computer,a power domain, a network port, and communications related to the T1,T2, and/or T3 networks.

Software/computer-readable instructions 322 can include hypervisorsoftware 324, which, when executed by processor(s) 310, can instantiatemultiple virtualized computers (i.e., hardware instances), such as butnot limited to, T2/mission virtual computer 330 a and T3/payload virtualcomputer 330 b. T2/mission virtual computer 330 a can control auxiliaryUMS systems 160 to provide auxiliary functionality for unmanned system100, and T3/payload virtual computer 330 b can control payload systems170 to provide payload-related functionality for unmanned system 100. Insome examples, hypervisor software 324 can provide more, fewer, and/ordifferent virtual computers than virtual computers 330 a and 330 b. Insome examples, T2/mission virtual computer 330 a can control auxiliaryUMS systems 160 using UMS control messages for controlling unmannedsystem 100, where the UMS control messages can be provided at least inpart as C2 messages and/or commands communicated using remote controlinterface 162.

Resource firewall hardware 314 can provide resource firewallingfunctionality for unmanned system 100. Resource firewallingfunctionality can relate to limiting access of processor cores to memoryand I/O allocated to those processor cores. For example, resourcefirewall hardware 314 can include memory management hardware forpreventing tasks running on a particular core of processor(s) 310 fromassessing memory regions assigned to other cores of processor(s) 310and/or related hardware for preventing a low criticality core fromaccessing higher criticality input/output devices and/or networks.

More specifically, resource firewalling functionality can include, butis not limited to, such as access control related to data storage 320and/or input/output devices, such as input/output devices accessible viaone or more input/output nodes. For example, resource firewall hardware314 can prevent a task running on one core from accessing memoryassigned to other tasks and/or cores; e.g., resource firewall hardware314 can prevent a task TASK1A running on core 312 a from accessingmemory allocated to a task TASK1B assigned to core 312 b and/or fromaccessing memory allocated to a different task TASK2A also assigned tocore 312 a. As another example, resource firewall hardware 314 can beused to ensure that a lower criticality task and/or core does not haveaccess to one or more input/output devices in a higher criticalitydomain; e.g., a task or core associated with T3 does not have access toan input/output device of T1 or T2; a task or core associated with T2does have access to input/output devices of T2 and perhaps T3, but doesnot have access to input/output devices of T1.

In some examples, resource firewall hardware 314 can include one or morememory, network, and/or I/O controllers. In some examples, resourcefirewall hardware 314 can also include firmware and/or software forperforming In some examples, resource firewall hardware 314 can provideother functionality related to data storage 320, including but notlimited to, functionality for: refreshing RAM of data storage 320,enabling and/or speeding up read and/or write access to data stored indata storage 320, buffering data transferred between processor(s) 310and data storage, additionally managing and/or controlling hardware ofdata storage 320, and/or additionally enabling and/or controlling flowof data going to and/or coming from data storage 320. In some examples,some or all of resource firewall hardware 314 can reside in otherhardware platforms than physical hardware 140; e.g., hardware of aninput/output node, hardware of data storage 320.

In addition to virtual computers 330 a, 330 b, hypervisor software 324can provide at least the additional capabilities: core assignment(assignment of virtual machines to cores of physical computer 140),interrupt handling including routing interrupt messages to virtualcomputers, execution scheduling of virtual computers 330 a, 330 b usingscheduler 332, memory space separation between virtual computers 330 a,330 b, device handling (device separation, sharing, and/or assignment)for input/output and/or other devices connected to physical computer 140and/or network switch 142, and secure application support. In someexamples, hypervisor software 324 can include LynxSecure™ SeparationKernel Hypervisor software from Lynx Software Technologies, Inc.

In some examples, one virtual computer can control one or more othervirtual computers. For example, T2/mission virtual computer 330 a canstart, restart, and stop T3/payload virtual computer 330 b. IfT2/mission virtual computer 330 a stops another virtual computer; e.g.,T3/payload virtual computer 330 b, then the stopped virtual computerceases executing software until the stopped virtual computer isrestarted; i.e., by T2/mission virtual computer 330 a. In particularexamples, a default condition for T3/payload virtual computer 330 b canbe the stopped condition; that is, T2/mission virtual computer 330 a hasto actively start execution of T3/payload virtual computer 330 b. Insome examples, a virtual computer associated with a lower-numberedcommunication tier/network can control a virtual computer associatedwith a higher-numbered communication tier/network, but not vice versa;e.g., T2/mission virtual computer 330 a can start, restart, and stopT3/payload virtual computer 330 b, but T2/mission virtual computer 330 acannot be started, restarted, and/or stopped by T3/payload virtualcomputer 330 b.

In some examples, cores of processor(s) 310 can be mapped to virtualcomputers; that is, a core is mapped or allocated to exclusive executionof software for a particular virtual computer. As a more particularexample, core 312 a can be mapped to T2/mission virtual computer 330 a,and core 312 b can be mapped to T3/payload virtual computer 330 b. Bymapping cores to virtual computers, computing hardware resources (cores)can be allocated to virtual computers ensuring that virtual computersalways have access to the computing hardware resources. Other mappingexamples are possible as well. In some examples, hypervisor software 324can instantiate one virtual computer per core of processor(s) 310—in thespecific example shown in FIG. 3, hypervisor software 324 caninstantiate four virtual computers: one for each of cores 312 a, 312 b,312 c, and 312 d.

In other examples, virtual computers may or may not be mapped to cores;rather, virtual computers can be scheduled by scheduler 332 to executeon one or more cores of processor(s) 310 for a “time slot” or maximumpredetermined amount of time (e.g., 500 microseconds, 1 millisecond, 2milliseconds, 100 milliseconds). For example, scheduler 332 can use around robin scheduling policy to provide time slots for executing eachvirtual computer on one or more cores designated for use by theexecuting virtual computer. In some of these examples, an amount of timerepresented by a time slot can depend on the virtual computer; e.g., atime slot for T2/mission virtual computer 330 a can be 1 unit of timelong, while a different time slot for T3/payload virtual computer 330 bcan be 2 units of time long, under the assumption that providing missionfunctionality will take less computing resources than providing payloadfunctionality. In other examples where providing mission functionalitytakes more computing resources than providing payload functionality, atime slot for T2/mission virtual computer 330 a can be 2 units of timelong, while a time slot for T3/payload virtual computer 330 b can be 1unit of time long. Many other examples of time slot determination arepossible as well.

As part of instantiating a virtual computer, hypervisor software 324 canallocate a portion of data storage 320 (e.g., 100 megabytes (MB), 1gigabyte (GB), 3 GB, 100 GB, etc.) for the use of the instantiatedvirtual computer. Hypervisor software 324 can also enforce otherresource limits on virtual computers than memory allocation limits. Forexample, hypervisor software 324, perhaps using scheduler 332, canensure that a lower-numbered tier's virtual computer is not interruptedfrom executing beyond a predefined maximum amount of time by executionof a higher-numbered tier's virtual computer. More specifically,hypervisor software 324 can ensure that T2/mission virtual computer 330a is not interrupted from executing beyond a predefined maximum amountof time (e.g., 1 millisecond, 2 milliseconds, 10 milliseconds) byexecution of T3/payload virtual computer 330 b, where the interruptedfrom execution could arise due to usage of processor(s) 310,input/output access, memory access, software and/or hardware faults,memory operations (e.g., memory allocation, deallocation, paging, etc.),rebooting, and/or due to other reasons.

Hypervisor software 324 can also ensure that data, communications,and/or other resources are not shared between communicationstiers/networks and that faults and/or other problematic behavior do notpropagate between communications tiers/networks. For example, hypervisorsoftware 324 can ensure that the T2 network is not accessible toT3/payload virtual computer 330 b operating in T3. In some examples,resource firewall hardware 314 and/or one or more criticality firewallscan be used along with hypervisor software 324 to provide resourcefirewalling to ensure that faults, incorrect memory and/or input/outputdevice accesses, and/or other problematic behavior do not propagatebetween communications tiers/networks.

Each virtual computer 330 a, 330 b, 430 can run an operating system;e.g., a Linux®-based operating system, a Microsoft® Windows® operatingsystem, an Android™ operating system, etc. In some examples, all ofvirtual computers 330 a, 330 b, 430 can run the same operating system;while in other examples, virtual computers 330 a, 330 b, 430 can run twoor more different operating systems.

Hypervisor software 324 can assign devices to virtual computers; e.g.,assign auxiliary UMS systems 160 and related fault and interruptinformation to T2/mission virtual computer 330 a, and/or assign payloadsystems 170 and related fault and interrupt information to T3/payloadvirtual computer 330 b. In some of these examples, most, if not all,commonly used hardware can be assigned to one virtual computer; e.g.,T2/mission virtual computer 330 a.

Hypervisor software 324 can provide virtualized access to some devicesacross multiple virtual computers as well; e.g., network switch 142. Forexample, FIG. 3 shows that hypervisor software 324 includes four networkports (NPs) 340, 342, 344, 346 for accessing network switch 142, andthrough link 362, auxiliary UMS systems 160 and payload systems 170.Network ports 340, 342, 344 are directly assigned to T2/mission virtualcomputer 330 a to communicate messages to the T2 network usingrespective T2 traffic 352, 354, 356. Network port 346 is a virtualizednetwork port that is accessible to both T2/mission virtual computer 330a and T3/payload virtual computer 330 b. Then, T2/mission virtualcomputer 330 a and T3/payload virtual computer 330 b can utilize networkport 346 to provide T3 traffic 358 to payload systems by way of link362.

By providing four network ports 340, 342, 344, 346, hypervisor software324 supports four separate communications grids to auxiliary UMS systems160 and payload systems 170—three of these communications grids arewithin the T2 network with auxiliary UMS systems 160 and onecommunication grid is within the T3 network with payload systems 170. Afirst of the T2 communications grids can be used for communications(e.g., T2 traffic 352) between T2/mission virtual computer 330 a andremote control interface 162. A second of the T2 communications gridscan be used for communications (e.g., T2 traffic 354) between T2/missionvirtual computer 330 a and input/output devices and/or input/outputnodes in the T2 network. A third of the T2 communications grids can beused for communications (e.g., T2 traffic 356) between T2/missionvirtual computer 330 a and a ground equipment network. The T3communications grid can be used to connect T2/mission virtual computer330 a and T3/payload virtual computer 330 b with payload systems 170,including but not limited to, remote payload communications (e.g.,uplink and/or downlink communications) devices of payload systems 170 aspart or all of T3 traffic 358.

In other examples, T2/mission virtual computer 330 a does not haveaccess to virtualized network port 346, and therefore does not havedirect access to the T3 network, including T3 traffic 358. Rather,T2/mission virtual computer 330 a can have a link to T2/mission virtualcomputer 330 a, which can provide indirect access to the T3 network,including T3 traffic 358 for T3/payload virtual computer 330 b. LinkingT2/mission virtual computer 330 a to T3/payload virtual computer 330 brather than to the T3 network can provide a level of security byprotecting the higher criticality T2/mission virtual computer 330 a fromunintended behavior of devices on the T3 network.

In some examples, physical computer 140 can have one or more userinterface components, network-communication interface components, and/orsensors. The user interface component(s) can include one or morecomponents that can receive input and/or provide output, perhaps to auser. Example user interface component(s) that can receive input and/orprovide output to and/or from a user and/or other entities include butare not limited to: a keyboard, a keypad, a touch screen, a touch pad, acomputer mouse, a track ball, a joystick, a button. cathode ray tubes(CRTs), liquid crystal displays (LCDs), light emitting diodes (LEDs),displays using digital light processing (DLP) technology, printers,light bulbs, a speaker, speaker jack, audio output port, audio outputdevice, earphones, and one or more components for generating hapticoutput.

The network-communication interface component(s) can be configured tosend and receive data over one or more wireless interfaces and/or one ormore wired interfaces to a data or other communications network; e.g.,the network-communication interface component(s) can be used by physicalcomputer 140 to communicate with network switch 142, core UMS systems150, auxiliary UMS systems 160, payload systems 170, and perhaps otherdevices. The wireless interface(s) if present, can utilize an airinterface, such as a Bluetooth®, ZigBee®, Wi-Fi™ and/or WiMAX™ interfaceto a data network, such as a wide area network (WAN), a local areanetwork (LAN), one or more public data networks (e.g., the Internet),one or more private data networks, or any combination of public andprivate data networks. The wired interface(s), if present, can comprisea wire, cable, fiber-optic link and/or similar physical connection to adata network, such as a WAN, a LAN, one or more public data networks,such as the Internet, one or more private data networks, or anycombination of such networks. In some examples, thenetwork-communication interface component(s) can be configured toprovide reliable, secured, and/or authenticated communications. For eachcommunication described herein, information for ensuring reliablecommunications (i.e., guaranteed message delivery) can be provided,perhaps as part of a message header and/or footer (e.g., packet/messagesequencing information, encapsulation header(s) and/or footer(s),size/time information, and transmission verification information such ascyclic redundancy check (CRC) and/or parity check values).Communications can be made secure (e.g., be encoded or encrypted) and/ordecrypted/decoded using one or more cryptographic protocols and/oralgorithms, such as, but not limited to, Data Encryption Standard (DES),Advanced Encryption Standard (AES), an Rivest-Shamir-Adelman (RSA)algorithm, a Diffie-Hellman algorithm, a secure sockets protocol such asSecure Sockets Layer (SSL) or Transport Layer Security (TLS), and/orDigital Signature Algorithm (DSA). Other cryptographic protocols and/oralgorithms can be used as well or in addition to those listed herein tosecure (and then decrypt/decode) communications.

In examples where physical computer 140 has one or more sensors, thesensor(s) can be configured to measure conditions in an environmentaround physical computer 140 and/or network switch 142 and provide dataabout the measured conditions of the environment, such as, but notlimited to sensors and data discussed above in the context of avionicsensor(s) 156 and payload sensor(s) 174.

FIG. 4 is another block diagram of a communications network of unmannedsystem 100, according to an example embodiment. The communicationsnetwork of FIG. 4 is closely related to the communications network ofFIG. 3. The main difference between the communications network of FIG. 3and the communications network of FIG. 4 is that T1 communications aresupported by the communications network of FIG. 4, but T1 communicationsare not supported by the communications network of FIG. 3. Thediscussion below of the communications network of FIG. 4 is intended tohighlight these differences—commonly-numbered items depicted in thecommunications networks of FIGS. 3 and 4 not discussed in the context ofthe communications network of FIG. 4 have the same functionality asdiscussed above in the context of the communications network of FIG. 3.

FIG. 4 shows that physical computer 140 is directly connected to coreUMS systems 150 via link 460. Link 460 carries communications, shown inFIG. 4 as T1 traffic 450, between physical computer 140 and core UMSsystems 150. Links 362 and 460 are separate physical links. Use ofseparate links 362 and 460 ensures that sufficient bandwidth isavailable (via link 460) for T1 traffic 450, no matter how muchbandwidth is utilized (via link 362) to convey T2 traffic 352, 354, 356,and T3 traffic 358. In other examples, a common link can carry T1traffic 450, T2 traffic 352, 354, 356, and T3 traffic 358.

Software/computer-readable instructions 322 can include hypervisorsoftware 324, which, when executed by processor(s) 310, can instantiatemultiple virtualized computers (i.e., hardware instances), such as butnot limited to, T1/main virtual computer 430, T2/mission virtualcomputer 330 a, and T3/payload virtual computer 330 b. T1/main virtualcomputer 430 can control core UMS systems 150 in the T1 network tosupport core functionality for unmanned system 100. In other examples,hypervisor software 324 can provide more, fewer, and/or differentvirtual computers than virtual computers 330 a, 330 b, 430. In additionto virtual computers 330 a, 330 b, 430, hypervisor software 324 canprovide at least the additional capabilities of hypervisor software 324discussed above in the context of FIG. 3.

In some examples, T1/main virtual computer 430 can control one or moreother virtual computers. For example, T1/main virtual computer 430 canstart, restart, and stop T2/mission virtual computer 330 a and/orT3/payload virtual computer 330 b. If T1/main virtual computer 430 stopsanother virtual computer; e.g., T2/mission virtual computer 330 a, thenthe stopped virtual computer ceases executing software until the stoppedvirtual computer is started by T1/main virtual computer 430. Inparticular examples, a default condition for each of T2/mission virtualcomputer 330 a and T3/payload virtual computer 330 b can be the stoppedcondition; that is, T1/main virtual computer 430 has to actively startexecution of T2/mission virtual computer 330 a and T3/payload virtualcomputer 330 b. In some examples, a virtual computer associated with alower-numbered communication tier/network can control a virtual computerassociated with a higher-numbered communication tier/network, but notvice versa; e.g., T1/main virtual computer 430 can start, restart, andstop T2/mission virtual computer 330 a and/or T3/payload virtualcomputer 330 b, but T1/main virtual computer 430 cannot be started,restarted, and/or stopped by either T2/mission virtual computer 330 a orT3/payload virtual computer 330 b.

In some examples, cores of processor(s) 310 can be mapped to virtualcomputers; that is, a core is mapped or allocated to exclusive executionof software for a particular virtual computer. As a more particularexample, core 312 a can be mapped to T1/main virtual computer 430, core312 b can be mapped to T2/mission virtual computer 330 a, and core 312 ccan be mapped to T3/payload virtual computer 330 b. Other mappingexamples are possible as well.

As mentioned above, scheduler 332 can use a round robin schedulingpolicy to provide a time slot for executing each virtual computer on oneor more cores designated for use by the executing virtual computer. Insome of these examples, an amount of time represented by a time slot candepend on the virtual computer; e.g., a time slot for T1/main virtualcomputer 430 can be 1 unit of time long, while separate time slots foreach of T2/mission virtual computer 330 a and T3/payload virtualcomputer 330 b can be 2 units of time long, under the assumption thatproviding core functionality will take less computing resourcesproviding mission functionality or providing payload functionality. Inother examples where providing core functionality takes more computingresources than providing mission functionality or providing payloadfunctionality, a time slot for T1/main virtual computer 430 can be 2units of time long, while separate time slots for each of T2/missionvirtual computer 330 a and T3/payload virtual computer 330 b can each be1 units of time long. Many other examples of time slot determination arepossible as well.

In other examples, virtual computers may or may not be mapped to cores;rather, virtual computers can be scheduled by scheduler 332 to executeon one or more cores of processor(s) 310 for a “time slot” or maximumpredetermined amount of time (e.g., 500 microseconds, 1 millisecond, 2milliseconds, 100 milliseconds). For example, scheduler 332 can use around robin scheduling policy to provide a time slot for executing eachvirtual computer on one or more cores designated for use by theexecuting virtual computer. In some of these examples, an amount of timerepresented by a time slot can depend on the virtual computer; e.g., atime slot for T2/mission virtual computer 330 a can be 1 unit of timelong, while a time slots for T3/payload virtual computer 330 b can be 2units of time long, under the assumption that providing missionfunctionality will take less computing resources than providing payloadfunctionality. In other examples where providing mission functionalitytakes more computing resources than providing payload functionality, atime slot for T2/mission virtual computer 330 a can be 2 units of timelong, while a time slots for T3/payload virtual computer 330 b can be 1unit of time long. Many other examples of time slot amounts of time arepossible as well.

In some examples, hypervisor software 324, perhaps using scheduler 332,can ensure that a lower-numbered tier's virtual computer is notinterrupted from executing beyond a predefined maximum amount of time byexecution of a higher-numbered tier's virtual computer. Morespecifically, hypervisor software 324 can ensure that T1/main virtualcomputer 430 is not interrupted from executing beyond a predefinedmaximum amount of time (e.g., 1 millisecond, 2 milliseconds, 10milliseconds) by execution of T2/mission virtual computer 330 a or byexecution of T3/payload virtual computer 330 b, where the interruptedfrom execution could arise due to usage of processor(s) 310,input/output access, memory access, software and/or hardware faults,memory operations (e.g., memory allocation, deallocation, paging, etc.),rebooting, and/or due to other reasons.

Hypervisor software 324 can assign devices to virtual computers; e.g.,assign core UMS systems 150 and related fault and interrupt informationto T1/main virtual computer 430. In some of these examples, most, if notall, commonly used hardware can be assigned to T1/main virtual computer430.

Hypervisor software 324 can also ensure that data, communications,and/or other resources are not shared between communicationstiers/networks and that faults and/or other problematic behavior do notpropagate between communications tiers/networks. For example, hypervisorsoftware 324 can ensure that the T1 network is not accessible toT2/mission virtual computer 330 a operating in T2 or T3/payload virtualcomputer 330 b.

Hypervisor software 324 can provide virtualized access to some devicesacross multiple virtual computers as well; e.g., network switch 142. Forexample, FIG. 4 shows that hypervisor software 324 includes four networkports 340, 342, 344, 346 for accessing network switch 142, and throughlink 362, auxiliary UMS systems 160 and payload systems 170. Networkports 340, 342, 344 are directly assigned to T1/main virtual computer430 to communicate messages to the T2 network using respective T2traffic 352, 354, 356. Network port 346 is a virtualized network portthat is accessible to each of T1/main virtual computer 430, T2/missionvirtual computer 330 a, and T3/payload virtual computer 330 b. Then,each of T1/main virtual computer 430, T2/mission virtual computer 330 a,and T3/payload virtual computer 330 b can utilize network port 346 toprovide T3 traffic 358 to payload systems using link 362.

By providing four network ports 340, 342, 344, 346, hypervisor software324 supports four separate communications grids to auxiliary UMS systems160 and payload systems 170—three of these communications grids arewithin the T2 network with auxiliary UMS systems 160 and onecommunication grid is within the T3 network with payload systems 170. Afirst of the T2 communications grids can be used for communications(e.g., T2 traffic 352) between T1/main virtual computer 430 and remotecontrol interface 162. A second of the T2 communications grids can beused for communications (e.g., T2 traffic 354) between T1/main virtualcomputer 430 and input/output devices and/or input/output nodes in theT2 network. A third of the T2 communications grids can be used forcommunications (e.g., T2 traffic 356) between T1/main virtual computer430 and a ground equipment network. The T3 communications grid can beused to connect T1/main virtual computer 430, T2/mission virtualcomputer 330 a, T3/payload virtual computer 330 b with payload systems170, including but not limited to, remote payload communications devices(e.g., uplink and/or downlink communications devices) of payload systems170 as part or all of T3 traffic 358.

In other examples, T1/main virtual computer 430 does not have access tovirtualized network port 346, and therefore does not have direct accessto the T3 network, including T3 traffic 358. Rather, T1/main virtualcomputer 430 can have a link to T2/mission virtual computer 330 a, whichcan provide indirect access to the T3 network, including T3 traffic 358for T1/main virtual computer 430. Linking T1/main virtual computer 430to T2/mission virtual computer 330 a rather than to the T3 network canprovide a level of security by protecting the higher criticality T1/mainvirtual computer 430 from unintended behavior of devices on the T3network.

FIG. 5 is a block diagram illustrating input/output node 500 of unmannedsystem 100, according to an example embodiment. For example, in unmannedsystem 100, one input/output node 500 can perform the tasks of oneinput/output node of one or more input/output nodes 144 or oneinput/output node of one or more input/output node(s) 146.

An input/output node, such as input/output node 500, can connect to andreceive digital and/or analog signals from input/output devices. Thedigital and/or analog signals can be processed and transmittedinput/output node to the physical computer using one or morecommunications protocols 540 (e.g., communications protocols such as,but not limited to, Ethernet, TCP/IP, UDP, CAN protocols, and RS-232).In some examples, input/output nodes can be connected together (e.g.,“daisy chained”) to provide additional capacity to communicate withinput/output devices. Use of input/output nodes by unmanned system 100can provide access to a wide range of input/output devices in a scalablemanner.

Input/output node 500 can include one or more ION processors 520, one ormore analog to digital converters (ADCs) 522, one or more controllerarea network (CAN) bus transceivers 524, and ION data storage 528. Insome examples, ION processor 520 can include a micro-controllerconfigured to act as an interface between input/output devices 530 and anetwork communicating signals, controls, and/or data 510 to networkswitch 142.

ION data storage 528 can include firmware, software, and/or data; e.g.,ION firmware 526 executable by ION processor 520 to perform some or allof the herein-described functionality of input/output node 500. In someexamples, ION firmware 526 can be stored in storage that is separatefrom ION data storage 528; e.g., ION firmware 526 can be stored in aread-only memory (ROM) and/or solid state device (SSD) memory that isseparate from ION data storage 528.

Input/output node 500 can provide analog and digital connections forcommunication with input/output devices 530 using communicationsprotocols 540. Input/output node 500 can receive signals frominput/output devices 530, packetize the received signals, and send thepacketized signals to physical computer 140, network switch 142, and/orpower module 200. Input/output node 500 can receive packetized signalsto physical computer 140, network switch 142, and/or power module 200,convert the packetized signals into analog and/or digital signals asneeded, and send the packetized signals and/or the analog and/or digitalsignals to input/output devices 530, packetize the received signals.

FIG. 5 illustrates that examples of input/output devices 530 include,but are not limited to, remote control interface 162, one or morelighting systems 164, one or more transponders 166, one or more payloaddevices 172, one or more payload sensors 174, and one or more devicesfor payload communications 176. The packetized signals can include oneor more packets transmitted as signals, controls, and/or data 510 frominput/output node 500 to physical computer 140 via network switch 142.In some examples, the one or more packets can include one or moreEthernet packets that comply with an IEEE 802.3 (or similar) protocol toprovide at least a predetermined amount of bandwidth (e.g., 10 megabitsper second (Mbps), 100 Mbps, 1 gigabit per second (Gbps)) betweeninput/output node 500 and network switch 142 As such, input/output node500 can decouple input/output processing of unmanned system 100 from thedigital and analog input/output pins available on physical computer 140and/or network switch 142.

In some examples, input/output node 500 can include one or more digitalports, one or more network ports, one or more CAN bus ports, one or moreUniversal Asynchronous Receiver/Transmitters (UARTs), and/or one or moredigital-to-analog (DAC) converters. In particular of these examples,some or all of the digital port(s) can be configurable as input ports oras output ports. In particular of these examples, the CAN bus port(s)and the one or more CAN bus transceivers 524 can support a CAN bus rateof at least 10 kilobits per second (kbps). In particular of theseexamples, the CAN bus port(s) can be bidirectional and are configurableto be individually enabled/disabled. In other examples, input/outputnode 500 can support Pulse Width Modulation (PWM) inputs and/or outputs.

Input/output node 500 can receive data signals from power module 200;e.g., input/output node 500 can current and/or voltage sense signal(s)232. In some examples, input/output node 500 can receive, process, andgenerate signals related to power system faults. For example,input/output node 500 can receive, process, and/or generate one or moreof power enable signal 212, payload power off signal 214, payload poweroff override signal 216, breaker reset signal 218, breaker state signal234, battery on signal 250, propulsion module fault signal 252, andtethered power system fault signal 254. More specifically, input/outputnode 500 can initialize a power module, such as power module 200 byproviding an asserted power enable signal 212, a de-asserted payloadpower off signal 214, and a de-asserted payload power off overridesignal 216.

Input/output node 500 can receive data about the signals related topower system faults from power module 200, fault status storage 260 ofpower fault logic 130, and/or other sources. For example, input/outputnode 500 can receive breaker state signal 234 from power module 200and/or corresponding data from fault status storage 260 of power faultlogic 130 regarding a state of circuit breaker 242 of power module 200.Then, if the received state of state of circuit breaker 242 is abreaker-open state, input/output node 500 can examine data related topower system faults (e.g., data related to battery on signal 250,propulsion module fault signal 252, and/or tethered power system faultsignal 254) and/or other information to determine whether circuitbreaker 242 can be reset to a breaker-closed state. If input/output node500 then determines that the circuit breaker 242 can be reset to thebreaker-closed state, input/output node 500 can generate an assertedbreaker reset signal 218, which power module 200 can receive andresponsively reset circuit breaker 242 to the breaker-closed state.

As another example, input/output node 500 can receive battery on signal250 from power module 200 and/or corresponding data from fault statusstorage 260 of power fault logic 130 regarding an on or off status forbattery 112. If the received battery on signal 250 is asserted,input/output node 500 can determine that battery 112 is on and inferthat a relatively large power fault has occurred, so that payloadsystems 170 should be powered down. In this event, input/output node 500can assert payload power off signal 214, which power module 200 canreceive and responsively power down payload systems 170. In some ofthese examples, power module 200 can be associated with a payload systemthat should remained powered up even when battery 112 is on; in theseexamples, input/output node 500 can determine that power module 200 isassociated with a payload system that should remained powered up, andassert both payload power off signal 214 and payload power off overridesignal 216 to override the general payload power off signal 214 for thepayload system that should remained powered up.

In some examples, physical computer 140 can receive, process, andgenerate signals related to power system faults in a similar fashion asdescribed for input/output node 500. Other examples of input/output node500 and/or physical computer 140 receiving, processing, and generatingsignals related to power system faults are possible as well.

In some examples, one or more personality modules can be utilized withinunmanned system 100 to enable remapping(s) of connector pins to aselected set of available signal types on an input/output node, such asinput/output node 500. A personality module can be a small, removablecircuit board that attaches to a connector on an input/output node,thereby enabling the input/output node to support of multipleconfigurations of equipment attached at a given connector (e.g., byinstalling appropriate personality module(s) for a given configurationof equipment.

FIG. 6 is a flowchart of method 600 for controlling an unmanned system,according to an example embodiment. Method 600 is executable by anunmanned system, such as unmanned system 100 described herein.

FIG. 6 indicates that method 600 begins at block 610, where the unmannedsystem can be provided; the unmanned system including a physicalcomputer, one or more auxiliary systems for the UMS, and a payload, suchas discussed herein in the context at least of FIGS. 1, 3, and 4.

In some examples, providing the unmanned system can include providing anautopilot and one or more servos for controlling one or more flightcontrol surfaces of the unmanned system as part of one or more coresystems for the unmanned system, such as discussed herein in the contextat least of FIG. 1.

At block 620, the physical computer of the unmanned system can executesoftware that causes the physical computer at least to instantiate aplurality of virtual computers that include a mission virtual computerand a payload virtual computer, where the mission virtual computer and apayload virtual computer can be for: controlling the one or moreauxiliary systems for the unmanned system using the mission virtualcomputer, communicating with the payload using the payload virtualcomputer, determining whether a software fault has occurred on onevirtual computer of the plurality of virtual computers, and afterdetermining that a software fault has occurred on one virtual computerof the plurality of virtual computers, preventing the software faultfrom causing a fault on a different virtual computer of the plurality ofvirtual computers, such as discussed herein in the context at least ofFIGS. 3 and 4.

In some examples, executing software on the physical computeradditionally can be for: sending a stop command to terminate softwareexecution to the payload virtual computer; and after sending the stopcommand, sending a start command to initiate software execution to thepayload virtual computer, such as discussed herein in the context atleast of FIGS. 3 and 4.

In some examples, controlling the one or more auxiliary systems for theunmanned system using the mission virtual computer can includecontrolling the one or more auxiliary systems for the unmanned systemusing the mission virtual computer using a second tier of communicationsbetween the physical computer and the one or more auxiliary systems forthe unmanned system, where the second tier of communications utilizes asecond link; where communicating with the payload using the payloadvirtual computer includes communicating with the payload using a thirdtier of communications between the physical computer and the payload,where the third tier of communications utilizes the second link; andwhere the second tier of communications is inaccessible to the payload,such as discussed herein in the context at least of FIGS. 3 and 4. Insome of these examples, the plurality of virtual computers can furtherinclude a core virtual computer that uses a first tier of communicationsand method 600 can further include: communicating with one or more coresystems for the unmanned system using the first tier of communicationsby at least communicating position and stability control messagesbetween the core virtual computer and the one or more core systems forthe unmanned system using the first tier of communications, such asdiscussed herein in the context at least of FIG. 4. In some of theseexamples, the one or more auxiliary systems for the unmanned system caninclude a remote control interface, and controlling the one or moreauxiliary systems for the unmanned system using the mission virtualcomputer using the second tier of communications can includecommunicating unmanned system control messages between the missionvirtual computer and the remote control interface using the second tierof communications, such as discussed herein in the context at least ofFIGS. 1 and 3. In some of these examples, communicating with the payloadusing the third tier of communications can include communicating payloadcontrol messages and payload data messages between the payload virtualcomputer and the payload using the third tier of communications, such asdiscussed herein in the context at least of FIGS. 1 and 3. In some ofthese examples, the third tier of communications can be associated witha third-tier network interface, and communicating payload controlmessages and payload data messages between the payload virtual computerand the payload using the third tier of communications can include:virtualizing the third-tier network interface into a first virtualizedthird-tier network interface and a second virtualized third-tier networkinterface, where the mission virtual computer is configured tocommunicate with the payload using the first virtualized third-tiernetwork interface, and where the payload virtual computer is configuredto communicate with the payload using the second virtualized third-tiernetwork interface, such as discussed herein in the context at least ofFIGS. 3 and 4.

In some examples, executing software on the physical computeradditionally can be for: executing software for the mission virtualcomputer on a first core of the physical computer; and executingsoftware for the payload virtual computer on a second core of thephysical computer, such as discussed herein in the context at least ofFIGS. 3 and 4.

In some examples, executing software on the physical computeradditionally can be for: scheduling execution of the mission virtualcomputer during a first time slot using a scheduler; and schedulingexecution of the payload virtual computer during a second time slotusing the scheduler, where the first time slot is separate from thesecond time slot, such as discussed herein in the context at least ofFIGS. 3 and 4.

In some examples, the software on the physical computer can includehypervisor software, determining whether a software fault has occurredon one virtual computer of the plurality of virtual computers caninclude determining whether a software fault has occurred on one virtualcomputer of the plurality of virtual computers using the hypervisorsoftware, and preventing the software fault from causing a fault on adifferent virtual computer of the plurality of virtual computers caninclude preventing the software fault from causing a fault on adifferent virtual computer of the plurality of virtual computers usingthe hypervisor software, such as discussed herein in the context atleast of FIGS. 3 and 4.

In some examples, the physical computer includes resource firewallhardware; then, method 700 can further include: preventing a taskexecuting on the second core of the physical computer from accessingmemory allocated to the first core of the physical computer using theresource firewall hardware, such as discussed herein in the context atleast of FIG. 3.

FIG. 7 is a flowchart of method 700 for providing an unmanned system,according to an example embodiment. Method 700 is executable by anunmanned system, such as unmanned system 100 described herein.

FIG. 7 indicates that method 700 begins at block 710, where the unmannedsystem can be provided, where the unmanned system can include one ormore core systems for the unmanned system, one or more auxiliary systemsfor the unmanned system, a payload, a physical computer, a network, anda power system, such as discussed herein in the context at least ofFIGS. 1-4.

In some examples, the one or more core systems for the unmanned systemcan include an autopilot and one or more servos for controlling one ormore flight control surfaces of the unmanned system, such as discussedherein in the context at least of FIG. 1.

In some examples, the network can include an input/output nodeconfigured to communicate with the physical computer using apacket-based interface and to receive inputs and provide outputs from aplurality of input/output devices via a plurality of communicationsprotocols, such as discussed herein in the context at least of FIG. 5.

At block 720, the unmanned system can logically separate the network andthe physical computer into at least a second tier of communications anda third tier of communications for at least: communicating between thephysical computer and the one or more auxiliary systems for the unmannedsystem using the second tier of communications, and communicatingbetween the physical computer and the payload using the third tier ofcommunications, such as discussed herein in the context at least ofFIGS. 1, 3, and 4.

In some examples, the physical computer can include software that, whenexecuted by the physical computer, causes the physical computer at leastto perform functionality of a plurality of virtual computers, such asdiscussed herein in the context at least of FIGS. 3 and 4. In some ofthese examples, the third tier of communications can be associated witha third-tier network interface, and the functionality of the pluralityof virtual computers can include: virtualizing the third-tier networkinterface into a plurality of virtualized third-tier network interfaces,where the plurality of virtual computers are configured to utilize theplurality of virtualized third-tier network interfaces to communicatewith the payload, such as discussed herein in the context at least ofFIGS. 3 and 4.

In some examples, the network can further enables the physical computerto communicate with the core systems for the UMS using a first tier ofcommunications that comprises position and stability control messages,such as discussed herein in the context at least of FIG. 1.

In some examples, the one or more auxiliary systems for the unmannedsystem can include a remote control interface, where the second tier ofcommunications can include unmanned system control messages communicatedbetween the physical computer and the remote control interface, such asdiscussed herein in the context at least of FIG. 1.

In some examples, the third tier of communications can include payloadcontrol messages and payload data messages communicated between thephysical computer and the payload, such as discussed herein in thecontext at least of FIG. 1. In some of these examples, the payload caninclude one or more sensors and the payload data messages can includedata collected by the one or more sensors, such as discussed herein inthe context at least of FIG. 1. In some of these examples, the payloadcan include an imaging system and the payload data messages include oneor more images and/or video imagery captured by the imaging system, suchas discussed herein in the context at least of FIG. 1.

In some examples, message traffic for both the second tier ofcommunications and the third tier of communications can be communicatedusing a single physical link of the network, such as discussed herein inthe context at least of FIGS. 3 and 4.

In some examples, the network can include a switching device configuredto logically separate the second tier of communications and the thirdtier of communications by at least: determining whether message trafficon the third tier of communications exceeds a third traffic threshold;and after determining that message traffic on the third tier ofcommunications exceeds a third traffic threshold, limiting messagetraffic on the third tier of communications to be less than the thirdtraffic threshold, such as discussed herein in the context at least ofFIG. 1. In some of these examples, the switching device can beconfigured to logically separate the second tier of communications andthe third tier of communications by at least: blocking all messagetraffic from the second tier of communications, from the third tier ofcommunications, or from both the second tier of communications and thethird tier of communications, such as discussed herein in the context atleast of FIG. 1.

At block 730, the power system of the unmanned system can provide afirst power domain for the one or more core systems for the unmannedsystem, a second power domain for the one or more auxiliary systems forthe unmanned system, and a third power domain for the payload, such asdiscussed herein in the context at least of FIGS. 1 and 2.

At block 740, the unmanned system can utilize first circuitry of thepower system to inhibit a single overcurrent fault in the third powerdomain from causing an electrical fault in either the first power domainor the second power domain, such as discussed herein in the context atleast of FIGS. 1 and 2.

At block 750, the unmanned system can utilize second circuitry of thepower system to inhibit a single overcurrent fault in the second powerdomain from causing an electrical fault in the first power domain, suchas discussed herein in the context at least of FIGS. 1 and 2.

In some examples, the first power domain can include a first powermodule, the second power domain can include a second power module, andthe third power domain can include a third power module, where the thirdpower module can include the first circuitry, and where the second powermodule can include the second circuitry, such as discussed herein in thecontext at least of FIGS. 1 and 2. In some of these examples, the firstpower module can include circuitry to provide a first set of functionsthat include a function for providing power and a function for sensingprovided power, such as discussed herein in the context at least of FIG.2. In some of these examples, the second power module can includecircuitry to provide a second set of functions that can include thefirst set of functions, a circuit breaking function, and a power on/offfunction, such as discussed herein in the context at least of FIG. 2. Insome of these examples, the second power module can include a circuitbreaker configured to performing the circuit breaking function, andwhere the second circuitry that inhibits a single overcurrent fault inthe second power domain from causing an electrical fault in the firstpower domain can include the circuit breaker, such as discussed hereinin the context at least of FIG. 2.

In some of these examples, the third power module can include circuitryto provide a third set of functions that include the second set offunctions and a function for powering down the payload in response to apower fault, such as discussed herein in the context at least of FIG. 2.In some of these examples, each of the first power module, the secondpower module and the third power module can include a mode indicator toselect between the first set of functions, the second set of functions,and the third set of functions, where the mode indicator for the firstpower module can be set to select the first set of functions, where themode indicator for the second power module can be set to select thesecond set of functions, and where the mode indicator for the thirdpower module can be set to select the third set of functions, such asdiscussed herein in the context at least of FIG. 2.

FIG. 8 is a flowchart of method 800 for operating an unmanned system,according to an example embodiment. Method 800 is executable by anunmanned system, such as unmanned system 100 described herein.

FIG. 8 indicates that method 800 begins at block 810, where the unmannedsystem can be provided, where the unmanned system can include one ormore core systems for the unmanned system, one or more auxiliary systemsfor the unmanned system, a payload, and a power system, such asdiscussed herein in the context at least of FIGS. 1-4.

At block 820, the power system of the unmanned system can provideuninterruptible power for a first power domain that can include the oneor more core systems for the unmanned system, such as discussed hereinin the context at least of FIGS. 1 and 2.

At block 830, the power system of the unmanned system can provideinterruptible power for each of a second power domain and a third powerdomain, where the second power domain can include the one or moreauxiliary systems for the unmanned system and the third power domain caninclude the payload, such as discussed herein in the context at least ofFIGS. 1 and 2.

At block 840, first circuitry of the power system of the unmanned systemcan prevent a single overcurrent fault in the third power domain fromcausing an electrical fault in either the first power domain or thesecond power domain, such as discussed herein in the context at least ofFIG. 2.

At block 850, second circuitry of the power system of the unmannedsystem can prevent a single overcurrent fault in the second power domainfrom causing an electrical fault in the first power domain, such asdiscussed herein in the context at least of FIG. 2.

In some examples, the first power domain can include a first powermodule and method 800 can further include: providing a first set offunctions using the first power module including: providing power to oneor more loads and sensing the power provided to the one or more loads,such as discussed herein in the context at least of FIG. 2. In some ofthese examples, providing power to the one or more loads can includeproviding power of a predetermined voltage to the one or more loads,such as discussed herein in the context at least of FIG. 2. In some ofthese examples, sensing power provided to the one or more loads caninclude: sensing a voltage of the power provided to the one or moreloads; sensing a current of the power provided to the one or more loads;or sensing both the voltage and the current of the power provided to theone or more loads, such as discussed herein in the context at least ofFIG. 2.

In some of these examples, the second power domain can include a secondpower module and method 800 can further include: providing a second setof functions using the second power module, the second set of functionsincluding: the first set of functions; providing a circuit breakingfunction for interrupting the interruptible power; and providing a poweron/off function for stopping the interruptible power based on a poweron/off signal, such as discussed herein in the context at least of FIG.2. In some of these examples, providing the circuit breaking functionfor interrupting the interruptible power can include interrupting theinterruptible power when a current of provided power exceeds a thresholdcurrent value that is selectable from among a plurality of thresholdcurrent values, such as discussed herein in the context at least of FIG.2.

In some of these examples, the second power module can include circuitryto receive a reset signal, and providing the circuit breaking functionfor interrupting the interruptible power can include responding to thereset signal by changing the circuit breaking function from a state todisabling the interruptible power to a state for enabling theinterruptible power, such as discussed herein in the context at least ofFIG. 2. In some of these examples, the power on/off function can beconfigured to be either in a power-on state or a power-off state, andproviding a power on/off function for stopping the interruptible powercan include: disabling the interruptible power when the power on/offfunction is in the power-off state; and enabling the interruptible powerwhen the power on/off function is in the power-on state, such asdiscussed herein in the context at least of FIG. 2. In some of theseexamples, the second power module can include a circuit breakerconfigured for performing the circuit breaking function, and preventinga single overcurrent fault in the second power domain from causing anelectrical fault in the first power domain using second circuitry of thepower system can include preventing a single overcurrent fault in thesecond power domain from causing an electrical fault in the first powerdomain using the circuit breaker, such as discussed herein in thecontext at least of FIG. 2

In some of these examples, the third power domain can include a thirdpower module, and method 800 can further include: providing a third setof functions using the third power module, the third set of functionsincluding: the second set of functions, disabling power to the payloadafter receiving an asserted payload-off signal; and enabling power tothe payload after receiving a de-asserted payload-off signal, such asdiscussed herein in the context at least of FIG. 2. In some of theseexamples, disabling power to the payload can include: detecting thesingle overcurrent fault in the first power domain; after detecting thesingle overcurrent fault in the first power domain, asserting theasserted payload-off signal to the third power module; and afterreceiving the asserted payload-off signal, the third power moduledisabling power to the payload, such as discussed herein in the contextat least of FIG. 2. In some of these examples, the unmanned systemfurther can include an input/output node connected to the third powermodule, and disabling power to the payload can include: detecting thesingle overcurrent fault in the third power domain using theinput/output node; after detecting the single overcurrent fault in thethird power domain, the input/output node asserting the assertedpayload-off signal; and after receiving the asserted payload-off signal,the third power module disabling power to the payload, such as discussedherein in the context at least of FIG. 2. In some of these examples,enabling power to the payload after a de-asserted payload-off signalreceived at the third power module can include: receiving an assertedpayload-off signal at the third power module; after receiving theasserted payload-off signal, receiving a payload-off-override signalthat de-asserts the payload-off signal at the third power module; andafter receiving the payload-off-override signal, the third power moduleenabling power to the payload, such as discussed herein in the contextat least of FIG. 2.

In some of these examples, each of the first power module, the secondpower module and the third power module can include a mode indicator toselect between a first set of functions associated with the first powerdomain, a second set of functions associated with the second powerdomain, and a third set of functions associated with the third powerdomain, and where the method further can include: setting the modeindicator of the first power module to select the first set offunctions; setting the mode indicator of the second power module toselect the second set of functions; and setting the mode indicator ofthe third power module to select the third set of functions, such asdiscussed herein in the context at least of FIG. 2.

In some examples, the unmanned system can further include a battery anda propulsion module, and providing uninterruptible power for the firstpower domain can include receiving power from a plurality of powersources that include the battery and the propulsion module, such asdiscussed herein in the context at least of FIG. 2.

FIG. 9 is a flowchart of method 900 for controlling an unmanned system,according to an example embodiment. Method 900 is executable by anunmanned system, such as unmanned system 100 described herein.

FIG. 9 indicates that method 900 begins at block 910, where the unmannedsystem can be provided, where the unmanned system can include a network,one or more auxiliary systems for the unmanned system, and a payload,where the network connects the one or more auxiliary systems for theunmanned system and the payload, such as discussed herein in the contextat least of FIGS. 1, 3, and 4.

At block 920, a network switch of the network of the unmanned system canlogically separate the network into at least a second tier ofcommunications and a third tier of communications, such as discussedherein in the context at least of FIGS. 1, 3, and 4.

At block 930, the network of the unmanned system can control theunmanned system using the network by at least: controlling the one ormore auxiliary systems for the unmanned system using messagescommunicated by the second tier of communications, and communicatingwith the payload using messages communicated by the third tier ofcommunications, such as discussed herein in the context at least ofFIGS. 1, 3, and 4.

In some examples, where providing the unmanned system can includeproviding an autopilot and one or more servos for controlling one ormore flight control surfaces of the unmanned system as part of one ormore core systems for the unmanned system, such as discussed herein inthe context at least of FIG. 1. In some of these examples, wherecontrolling the unmanned system using the network further can includecommunicating messages for position and stability controls with at leastthe core systems for the unmanned system using the network, such asdiscussed herein in the context at least of FIG. 1. In some of theseexamples, the one or more auxiliary systems for the unmanned system caninclude a remote control interface, and controlling the unmanned systemusing the network can further include: determining whether the remotecontrol interface is inactive; and after determining that the remotecontrol interface is inactive, sending one or more messages for positionand stability controls to at least the one or more core systems for theunmanned system, such as discussed herein in the context at least ofFIG. 1. In some of these examples, where logically separating thenetwork into at least the second tier of communications and the thirdtier of communications can include logically separating the network intoat least a first tier of communications, the second tier ofcommunications, and the third tier of communications, the first tier ofcommunications used for controlling the one or more core systems for theunmanned system, such as discussed herein in the context at least ofFIGS. 1 and 4.

In some examples, logically separating the network can include:determining whether message traffic on the third tier of communicationsexceeds a third traffic threshold; and after determining that messagetraffic on the third tier of communications exceeds a third trafficthreshold, limiting message traffic on the third tier of communicationsto be no more than the third traffic threshold, such as discussed hereinin the context at least of FIG. 1. In some of these examples, the thirdtier of communications can include a first type of messages and a secondtype of messages, and limiting message traffic on the third tier ofcommunications to be no more than the third traffic threshold caninclude: determining whether first bandwidth used by message traffic ofthe first type of messages exceeds a first bandwidth threshold; afterdetermining that the first bandwidth exceeds the first bandwidththreshold, limiting bandwidth used by message traffic of the first typeof messages to no more than the first bandwidth threshold; determiningwhether second bandwidth used by message traffic of the second type ofmessages exceeds a second bandwidth threshold; and after determiningthat the second bandwidth exceeds the second bandwidth threshold,limiting bandwidth used by message traffic of the second type ofmessages to no more than the second bandwidth threshold, such asdiscussed herein in the context at least of FIG. 1.

In some examples, the network can include a first link and a second linkthat are physically separate, and controlling the unmanned system usingthe network can include: communicating messages for a first tier ofcommunications using the first link; and communicating messages for boththe second tier of communications and the third tier of communicationsusing the second link, such as discussed herein in the context at leastof FIG. 4.

In some examples, logically separating the network can include: usingthe network switch to block all message traffic from the second tier ofcommunications, from the third tier of communications, or from both thesecond tier of communications and the third tier of communications, suchas discussed herein in the context at least of FIG. 1.

In some examples, the network further can include one or moreinput/output nodes, and where controlling the one or more auxiliarysystems for the unmanned system using messages communicated by thesecond tier of communications can include communicating the messagescommunicated by the second tier of communications using the one or moreinput/output nodes, such as discussed herein in the context at least ofFIGS. 1 and 5. In some of these examples, the one or more input/outputnodes support a plurality of communications protocols, and wherecommunicating the messages communicated by the second tier ofcommunications using the one or more input/output nodes can includecommunicating the messages communicated by the second tier ofcommunications using the plurality of communications protocols of theone or more input/output nodes, such as discussed herein in the contextat least of FIGS. 1 and 5.

In some examples, the unmanned system can include a physical computerhaving software that when executed, causes the physical computer toperform functionality of a mission virtual computer and a payloadvirtual computer; where controlling the one or more auxiliary systemsfor the unmanned system can include communicating messages on the secondtier of communications between the mission virtual computer and the oneor more auxiliary systems for the unmanned system; and wherecommunicating with the payload using messages communicated by the thirdtier of communications can include communicating messages on the thirdtier of communications between the payload virtual computer and thepayload, such as discussed herein in the context at least of FIGS. 1, 3,and 4.

The novel features believed characteristic of the illustrativeembodiments are set forth in the appended claims. The illustrativeembodiments, however, as well as a preferred mode of use, furtherobjectives and descriptions thereof, will best be understood byreference to the present specification when read in conjunction with theaccompanying drawings in which some, but not all of the disclosedembodiments may be shown.

It should be understood that for this and other processes and methodsdisclosed herein, flowcharts show functionality and operation of onepossible implementation of present embodiments. In this regard, eachblock may represent a module, a segment, or a portion of program code,which includes one or more instructions executable by a processor forimplementing specific logical functions or steps in the process. Theprogram code may be stored on any type of computer readable medium ordata storage, for example, such as a storage device including a disk orhard drive. Further, the program code can be encoded on acomputer-readable storage media in a machine-readable format, or onother non-transitory media or articles of manufacture. The computerreadable medium may include non-transitory computer readable medium ormemory, for example, such as computer-readable media that stores datafor short periods of time like register memory, processor cache andRandom Access Memory (RAM). The computer readable medium may alsoinclude non-transitory media, such as secondary or persistent long termstorage, like read only memory (ROM), optical or magnetic disks,compact-disc read only memory (CD-ROM), for example. The computerreadable media may also be any other volatile or non-volatile storagesystems. The computer readable medium may be considered a tangiblecomputer readable storage medium, for example.

In addition, each block in the disclosed flowcharts may representcircuitry that is wired to perform the specific logical functions in theprocess. Alternative implementations are included within the scope ofthe example embodiments of the present disclosure in which functions maybe executed out of order from that shown or discussed, includingsubstantially concurrent or in reverse order, depending on thefunctionality involved, as would be understood by those reasonablyskilled in the art.

The description of the different advantageous arrangements has beenpresented for purposes of illustration and description, and is notintended to be exhaustive or limited to the embodiments in the formdisclosed. Many modifications and variations will be apparent to thoseof ordinary skill in the art. Further, different advantageousembodiments may describe different advantages as compared to otheradvantageous embodiments. The embodiment or embodiments selected arechosen and described in order to best explain the principles of theembodiments, the practical application, and to enable others of ordinaryskill in the art to understand the disclosure for various embodimentswith various modifications as are suited to the particular usecontemplated.

What is claimed is:
 1. A method, comprising: providing an unmannedsystem (UMS) that comprises one or more core systems for the UMS, one ormore auxiliary systems for the UMS, a payload, and a power system;providing uninterruptible power for a first power domain using the powersystem, the first power domain including the one or more core systemsfor the UMS; providing interruptible power for each of a second powerdomain and a third power domain using the power system, the second powerdomain including the one or more auxiliary systems for the UMS, and thethird power domain including the payload; preventing a singleovercurrent fault in the third power domain from causing an electricalfault in either the first power domain or the second power domain usingfirst circuitry of the power system; and preventing a single overcurrentfault in the second power domain from causing an electrical fault in thefirst power domain using second circuitry of the power system.
 2. Themethod of claim 1, wherein the first power domain comprises a firstpower module, and wherein the method further comprises: providing afirst set of functions using the first power module comprising:providing power to one or more loads and sensing the power provided tothe one or more loads.
 3. The method of claim 2, wherein providing powerto the one or more loads comprises providing power of a predeterminedvoltage to the one or more loads.
 4. The method of claim 2, whereinsensing power provided to the one or more loads comprises: sensing avoltage of the power provided to the one or more loads; sensing acurrent of the power provided to the one or more loads; or sensing boththe voltage and the current of the power provided to the one or moreloads.
 5. The method of claim 2, wherein the second power domaincomprises a second power module, and wherein the method furthercomprises: providing a second set of functions using the second powermodule, the second set of functions comprising: the first set offunctions; providing a circuit breaking function for interrupting theinterruptible power; and providing a power on/off function for stoppingthe interruptible power based on a power on/off signal.
 6. The method ofclaim 5, wherein providing the circuit breaking function forinterrupting the interruptible power comprises interrupting theinterruptible power when a current of provided power exceeds a thresholdcurrent value that is selectable from among a plurality of thresholdcurrent values.
 7. The method of claim 6, wherein the second powermodule comprises circuitry to receive a reset signal, and whereinproviding the circuit breaking function for interrupting theinterruptible power comprises responding to the reset signal by changingthe circuit breaking function from a state to disabling theinterruptible power to a state for enabling the interruptible power. 8.The method of claim 5, wherein the power on/off function is configuredto be either in a power-on state or a power-off state, and whereinproviding a power on/off function for stopping the interruptible powercomprises: disabling the interruptible power when the power on/offfunction is in the power-off state; and enabling the interruptible powerwhen the power on/off function is in the power-on state.
 9. The methodof claim 5, wherein the second power module comprises a circuit breakerconfigured for performing the circuit breaking function, and whereinpreventing a single overcurrent fault in the second power domain fromcausing an electrical fault in the first power domain using secondcircuitry of the power system comprises preventing a single overcurrentfault in the second power domain from causing an electrical fault in thefirst power domain using the circuit breaker.
 10. The method of claim 5,wherein the third power domain comprises a third power module, andwherein the method further comprises: providing a third set of functionsusing the third power module, the third set of functions comprising: thesecond set of functions; disabling power to the payload after receivingan asserted payload-off signal; and enabling power to the payload afterreceiving a de-asserted payload-off signal.
 11. The method of claim 10,wherein disabling power to the payload comprises: detecting the singleovercurrent fault in the first power domain; after detecting the singleovercurrent fault in the first power domain, asserting the assertedpayload-off signal to the third power module; and after receiving theasserted payload-off signal, the third power module disabling power tothe payload.
 12. The method of claim 11, wherein the UMS furthercomprises an input/output node connected to the third power module, andwherein disabling power to the payload comprises: detecting the singleovercurrent fault in the third power domain using the input/output node;after detecting the single overcurrent fault in the third power domain,the input/output node asserting the asserted payload-off signal; andafter receiving the asserted payload-off signal, the third power moduledisabling power to the payload.
 13. The method of claim 10, whereinenabling power to the payload after a de-asserted payload-off signalreceived at the third power module comprises: receiving an assertedpayload-off signal at the third power module; after receiving theasserted payload-off signal, receiving a payload-off-override signalthat de-asserts the payload-off signal at the third power module; andafter receiving the payload-off-override signal, the third power moduleenabling power to the payload.
 14. The method of claim 10, wherein eachof the first power module, the second power module and the third powermodule comprises a mode indicator to select between a first set offunctions associated with the first power domain, a second set offunctions associated with the second power domain, and a third set offunctions associated with the third power domain, and wherein the methodfurther comprises: setting the mode indicator of the first power moduleto select the first set of functions; setting the mode indicator of thesecond power module to select the second set of functions; and settingthe mode indicator of the third power module to select the third set offunctions.
 15. The method of claim 1, wherein the UMS further comprisesa battery and a propulsion module, and wherein providing uninterruptiblepower for the first power domain comprises receiving power from aplurality of power sources that comprise the battery and the propulsionmodule.
 16. An unmanned system (UMS), comprising: one or more coresystems for the UMS; one or more auxiliary systems for the UMS; apayload; and a power system, configured for: providing uninterruptiblepower for a first power domain using the power system, the first powerdomain including the one or more core systems for the UMS; providinginterruptible power for each of a second power domain and a third powerdomain using the power system, the second power domain including the oneor more auxiliary systems for the UMS, and the third power domainincluding the payload; preventing a single overcurrent fault in thethird power domain from causing an electrical fault in either the firstpower domain or the second power domain using first circuitry of thepower system; and preventing a single overcurrent fault in the secondpower domain from causing an electrical fault in the first power domainusing second circuitry of the power system.
 17. The UMS of claim 16,wherein the first power domain comprises a first power module havingcircuitry to provide at least a first set of functions, the first set offunctions including a function for providing power to one or more loadsand a function for sensing the power provided to the one or more loads.18. The UMS of claim 17, wherein the second power domain comprises asecond power module having circuitry to provide at least a second set offunctions, the second set of functions including: the first set offunctions, a circuit breaking function for interrupting theinterruptible power, and a power on/off function for stopping theinterruptible power based on a power on/off signal.
 19. The UMS of claim18, wherein the third power domain comprises a third power module havingcircuitry to provide at least a third set of functions, the third set offunctions including: the second set of functions, a function fordisabling power to the payload after receiving an asserted payload-offsignal, and a function for enabling power to the payload after receivinga de-asserted payload-off signal.
 20. The UMS of claim 19, wherein eachof the first power module, the second power module and the third powermodule comprises a mode indicator to select between the first set offunctions, the second set of functions, and the third set of functions,wherein the mode indicator for the first power module is set to selectthe first set of functions, wherein the mode indicator for the secondpower module is set to select the second set of functions, and whereinthe mode indicator for the third power module is set to select the thirdset of functions.